CVSS 4.0
6.9 mediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:UCVE-2026-40178
Medium (6.9) in ajenti ajenti plugin core. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in ajenti-plugin-core 0.112.
ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible during a short moment after the authentication of an user to bypass its authentication. This vulnerability is fixed in 0.112.
Severity
CVSS 3.1
5.9 mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 14% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-287, CWE-362
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ajenti:ajenti_plugin_core
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8647-755q-fw9p | PyPI | ajenti-plugin-core | <0.112 | 0.112 |
| PYSEC-2026-2340 | PyPI | ajenti-plugin-core | <0.112 | 0.112 |