GHSA-h6mp-mc7g-mg49: scheb/two-factor-bundle bypass two-factor authentication with unverified JWT trusted device token

May 21, 2024

Before version 3.7 the bundle is vulnerable to a security issue in JWT, which can be exploited by an attacker to generate trusted device cookies on their own, effectively by-passing two-factor authentication.

References

github.com/FriendsOfPHP/security-advisories/blob/master/scheb/two-factor-bundle/2018-07-08.yaml
github.com/advisories/GHSA-h6mp-mc7g-mg49
github.com/scheb/two-factor-bundle
github.com/scheb/two-factor-bundle/commit/8890c1e47ae89e0ac6f8a40fd4bb4b91c2081aa7
github.com/scheb/two-factor-bundle/issues/143

Code Behaviors & Features

Detect and mitigate GHSA-h6mp-mc7g-mg49 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →