Documenso EUVD-2026-40043

Exploitation requires that Google OAuth login is enabled on the target Documenso instance - this is not enabled by default in self-hosted deployments and requires explicit OAuth client configuration with Google credentials. The targeted user account must have two-factor authentication enabled; accounts without 2FA are unaffected by this specific bypass since there is no second factor to circumvent. The attacker must know the target user's Google account identity to initiate the OAuth flow on their behalf. Attack Complexity is rated High (AC:H), indicating the attacker must correctly manipulate OAuth callback URL parameters during a narrow window in the authentication flow - reliable exploitation is not trivial. No prior Documenso authentication is required (PR:N from the CVSS vector). The vulnerability does not affect email/password login paths; it is strictly limited to the Google OAuth code path.

The CVSS 4.0 score of 6.3 with AV:N/AC:H accurately reflects a meaningful but operationally constrained risk. The High Attack Complexity rating is the critical moderating factor - exploitation requires precise timing or parameter manipulation during the OAuth callback sequence, making mass or automated exploitation unlikely. Impact metrics VC:L/VI:L/VA:L indicate per-account scope with no lateral movement to other systems (SC/SI/SA all N), meaning each successful exploit yields access to a single user account, not a system-wide breach. The publicly available exploit code (E:P) meaningfully raises real-world risk above purely theoretical. Absence from CISA KEV confirms no confirmed widespread active exploitation. This is a genuine priority for Documenso deployments where Google OAuth is enabled and users rely on 2FA as a security control - the bypass directly negates that control - but low EPSS expectation and High AC limit urgency for most operators. No conflicting signals between the CVSS vector and the description.

An attacker who knows a target user's Google account email initiates the Google OAuth login flow against a Documenso instance, then manipulates the OAuth callback URL parameters to omit or subvert the oauth2fa=true signal, causing the application to skip the verify2fa() call and complete authentication without prompting for a TOTP code. A publicly available exploit demonstrating this technique exists at https://github.com/documenso/documenso/issues/2758. The High Attack Complexity rating implies the attacker must understand the specific callback parameter mechanics and may need to intercept or craft the redirect precisely, limiting opportunistic exploitation.