CVE-2022-42731

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-294

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/mkalioby/django-mfa2/blob/0936ea253354dd95cb127f09d0efa31324caef27/mfa/FIDO2.py#L58Exploit, Third Party Advisory
https://github.com/mkalioby/django-mfa2/releases/tag/v2.5.1-releaseRelease Notes, Third Party Advisory
https://github.com/mkalioby/django-mfa2/releases/tag/v2.6.1-releaseRelease Notes, Third Party Advisory
https://github.com/mkalioby/django-mfa2/blob/0936ea253354dd95cb127f09d0efa31324caef27/mfa/FIDO2.py#L58Exploit, Third Party Advisory
https://github.com/mkalioby/django-mfa2/releases/tag/v2.5.1-releaseRelease Notes, Third Party Advisory
https://github.com/mkalioby/django-mfa2/releases/tag/v2.6.1-releaseRelease Notes, Third Party Advisory

Timeline

Published: Oct 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-427327.5A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service usi CVE-2022-427337.5A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service usi CVE-2022-427347.5A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service usi CVE-2022-427358.8Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu. ShenYu Admin allows low-privilege low-level admin CVE-2022-42749.8A vulnerability, which was classified as critical, was found in House Rental System. Affected is an unknown function of the file /view-prope CVE-2022-427435.3deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the applicati CVE-2022-427449.8CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is possible because the ap CVE-2022-427457.5CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This is possible because the application is vul CVE-2022-427466.1CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This CVE-2022-427476.1CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is CVE-2022-427486.1CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. T CVE-2022-427496.1CandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is po