CVSS 4.0
9.3 criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCVE-2026-40177
Critical (9.3) in ajenti ajenti plugin core. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in ajenti-plugin-core 0.112.
ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible to bypass the password authentication This vulnerability is fixed in 0.112.
Severity
CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 26% of CVEs (scores of 2026-10-31)
- CWE
- CWE-287
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ajenti:ajenti_plugin_core
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3mcx-6wxm-qr8v | PyPI | ajenti-plugin-core | <0.112 | 0.112 |
| PYSEC-2026-266 | PyPI | ajenti-plugin-core | <0.112 | 0.112 |