GHSA-74r7-3mjm-jc5v eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
Unauthenticated attackers can lock out all users in a resolver by incrementing failcounters via the validate endpoint, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-74r7-3mjm-jc5v?
GHSA-74r7-3mjm-jc5v is a denial of service vulnerability in edumfa, published on 18 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
If the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased.
Patches
This, along with other issues, was fixed in eduMFA v2.9.1.
Workarounds
Limiting access to /validate/check to client applications (i.e. Shibboleth/FreeRADIUS) using an authorization policy with api_key_required or using e.g. the reverse proxy.
Which versions are affected by GHSA-74r7-3mjm-jc5v?
2 open source packages ship an affected version, including edumfa.
| Package | Affected | Fixed in |
|---|---|---|
edumfa PyPI | All versions | 2.9.1 |
edumfa PyPI | All versions | 2.9.1 |
How do I fix GHSA-74r7-3mjm-jc5v?
Upgrade edumfa to 2.9.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-74r7-3mjm-jc5v being exploited?
There is no known exploitation of GHSA-74r7-3mjm-jc5v in the wild and no public exploit code.