Open-source package vulnerability · PyPI
CVE-2026-40177: ajenti.plugin.core has password bypass when 2FA is activated
criticalCVSS 4.0 9.1 · 3.1 7.5GHSA-3mcx-6wxm-qr8v
Impact If the 2FA was activated, it was possible to bypass the password authentication Patches This is fixed in the version 0.112. Users should upgrade to this version as soon as possible.
Published Apr 10, 2026 · Updated Apr 24, 2026
Affected packages
ajenti.plugin.core
- Ecosystem
- PyPI
- Affected
- < 0.112
- Fixed in
- 0.112
- Check
pip show ajenti.plugin.core
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
If the 2FA was activated, it was possible to bypass the password authentication
Patches
This is fixed in the version 0.112. Users should upgrade to this version as soon as possible.
Credited to hansmach1ne.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology