CVE-2019-16766

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-290 CWE-304

Affected software

Vendor	Product	Versions
Lab Digital	wagtail-2fa	>= < 1.3.0, < 1.3.0

References

https://github.com/LabD/wagtail-2fa/security/advisories/GHSA-89px-ww3j-g2mmThird Party Advisory
https://github.com/labd/wagtail-2fa/commit/13b12995d35b566df08a17257a23863ab6efb0caPatch, Third Party Advisory
https://github.com/labd/wagtail-2fa/commit/a6711b29711729005770ff481b22675b35ff5c81Patch, Third Party Advisory
https://github.com/LabD/wagtail-2fa/security/advisories/GHSA-89px-ww3j-g2mmThird Party Advisory
https://github.com/labd/wagtail-2fa/commit/13b12995d35b566df08a17257a23863ab6efb0caPatch, Third Party Advisory
https://github.com/labd/wagtail-2fa/commit/a6711b29711729005770ff481b22675b35ff5c81Patch, Third Party Advisory

Timeline

Published: Nov 29, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-167677.2The admin sys mode is now conditional and dedicated for the special case. By default, since ezmaster@5.2.11 no instance (container) is launc CVE-2019-167684.3In affected versions of Sylius, exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Secu CVE-2019-167695.4The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against CVE-2019-16774.6A vulnerability in Cisco Webex Meetings for Android could allow an unauthenticated, local attacker to perform a cross-site scripting attack CVE-2019-167707.5In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a den CVE-2019-167716.5Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject a CVE-2019-167726.1The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsa CVE-2019-167749.8In phpfastcache before 5.1.3, there is a possible object injection vulnerability in cookie driver.CVE-2019-167756.5Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files o CVE-2019-167768.1Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the inte CVE-2019-167776.5Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binar CVE-2019-167789.8In TensorFlow before 1.15, a heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32. In this c