CVE-2026-40178 — ajenti.plugin.core has a race conditions in 2FA

CVE-2026-40178

ajenti.plugin.core has a race conditions in 2FA PUBLISHED

Description (CNA)

ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible during a short moment after the authentication of an user to bypass its authentication. This vulnerability is fixed in 0.112.

Affected (CNA)

Vendor / product	Versions
ajenti / ajenti	affected < 0.112

CWE

CWE-287, CWE-362

References

https://github.com/ajenti/ajenti/security/advisories/GHSA-8647-755q-fw9p

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.