CVE-2026-4208 — Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email)

CVE-2026-4208

Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email) PUBLISHED

Description (CNA)

The extension fails to properly reset the generated MFA code after successful authentication. This leads to a possible MFA bypass for future login attempts by providing an empty string as MFA code to the extensions MFA provider.

Affected (CNA)

Vendor / product	Versions
TYPO3 / Extension "E-Mail MFA Provider"	affected 0 through 1.0.5; affected 2.0.0

CWE

CWE-639

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-007

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.