CVE-2026-28510 | BDVDB-2026-330489 Detail

Description#

eLabFTW is an open source electronic lab notebook. In elabftw versions through 5.4.1, the login flow did not reliably preserve the multi-factor authentication state across authentication steps. Under certain conditions, an attacker with valid primary credentials could complete authentication with an attacker-controlled TOTP secret and bypass the additional factor. This could result in unauthorized account access. This issue is fixed in version 5.4.2.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-05-05Record published in the CVE List.
2. Version 22026-05-06Most recent update recorded in the CVE List.