What’s Vulnerable › Vulnerabilities
CVE-2026-40177: Password bypass when 2FA is activated
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-04-10 · updated 2026-06-17
- Weakness: CWE-287
Description
ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible to bypass the password authentication This vulnerability is fixed in 0.112.
Affected products
- Ajenti Plugin Core: before 0.112 — fixed in 0.112
How to fix
Upgrade to a fixed version: Ajenti Plugin Core 0.112. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-40177 or the next vulnerability affects your stack