What’s Vulnerable › Vulnerabilities

CVE-2020-5240: 2FA bypass through deleting devices in wagtail-2fa

• Severity: high (CVSS 8.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-03-13 · updated 2026-06-17
• Weakness: CWE-285

Description

In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially compromise the account if they figure out their password. The problem has been patched in version 1.4.1.

Affected products

• Lab Digital wagtail-2fa: before 1.4.1 — fixed in 1.4.1

How to fix

Upgrade to a fixed version: Lab Digital wagtail-2fa 1.4.1. Check the vendor advisory for mitigations.

References

• https://github.com/labd/wagtail-2fa/commit/ac23550d33b7436e90e3beea904647907eba5b74
• https://github.com/labd/wagtail-2fa/security/advisories/GHSA-9gjv-6qq6-v7qm
• https://github.com/labd/wagtail-2fa/commit/ac23550d33b7436e90e3beea904647907eba5b74
• https://github.com/labd/wagtail-2fa/security/advisories/GHSA-9gjv-6qq6-v7qm

Get alerted when CVE-2020-5240 or the next vulnerability affects your stack