EUVD-2026-40043
GHSA-3hjr-gmh6-w2qr
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable OAuth 2FA bypass requires high-complexity callback manipulation; no prior auth needed, but impact is limited to per-account confidentiality and integrity with no availability consequence.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was detected in Documenso up to 2.11.0. Affected by this vulnerability is an unknown functionality of the file packages/auth/server/lib/utils/handle-oauth-callback-url.ts of the component Google OAuth Login. The manipulation results in improper authentication. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitation appears to be difficult. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance.
AnalysisAI
Google OAuth login in Documenso through version 2.11.0 fails to enforce two-factor authentication during the OAuth callback flow, allowing a remote attacker to authenticate as any Google-linked user without completing MFA verification. The flaw resides in handle-oauth-callback-url.ts, where the oauth2fa state is not properly routed through the dedicated OAuth 2FA verification path - as confirmed by the PR diff showing the signin form was not checking the oauth2fa=true callback parameter. Publicly available exploit code exists (GitHub issue #2758), though no active exploitation has been confirmed and the CVSS 4.0 AC:H rating indicates the attack requires precise manipulation of the OAuth callback flow.
Technical ContextAI
Documenso is an open-source document signing platform built on a Remix/Next.js stack with a custom authentication library. The vulnerable component is packages/auth/server/lib/utils/handle-oauth-callback-url.ts, which processes the Google OAuth callback. The PR diff (PR #2837) reveals the root cause: the SignInForm component was not reading the oauth2fa query parameter from the callback URL, so OAuth-returning users with 2FA enabled were routed through the standard emailPassword.signIn() path instead of the dedicated authClient.oauth.verify2fa() path, effectively skipping second-factor enforcement. CWE-287 (Improper Authentication) applies because the system fails to verify the user's identity through all required authentication factors when the OAuth code path is used. CPE cpe:2.3:a:n/a:documenso:*:*:*:*:*:*:*:* covers all versions through 2.11.0.
RemediationAI
Apply the upstream fix from GitHub PR #2837 (https://github.com/documenso/documenso/pull/2837), which adds useSearchParams detection for the oauth2fa=true callback parameter and routes OAuth users through authClient.oauth.verify2fa() for proper 2FA enforcement. Important caveat: this PR was awaiting acceptance at time of reporting and a released tagged version incorporating the fix has not been confirmed - monitor the Documenso GitHub repository (https://github.com/documenso/documenso/) for a merged release before deploying. As a compensating control, disabling Google OAuth login entirely eliminates the attack surface at the cost of forcing users to email/password authentication. Alternatively, restricting OAuth login to a controlled Google Workspace domain reduces the attacker population. If neither option is feasible, enabling audit logging on all OAuth login events and alerting on logins that bypass expected 2FA prompts provides detection capability. No workaround fully mitigates the flaw while keeping Google OAuth active.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today