Improper Input Validation Affecting edumfa package, versions [,2.9.1)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-EDUMFA-17670569
- published29 Jun 2026
- disclosed18 May 2026
- creditUnknown
Introduced: 18 May 2026
CVE NOT AVAILABLE CWE-20 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade edumfa to version 2.9.1 or higher.
Overview
edumfa is an eduMFA: identity, multifactor authentication (OTP), authorization, audit
Affected versions of this package are vulnerable to Improper Input Validation via the /validate/check endpoint when the resolver parameter is provided for a non-existent user. An attacker can cause all failcounters of tokens associated with the specified resolver to increment by repeatedly sending requests with arbitrary resolver values.