eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
Impact
In eduMFA < 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire
Patches
Fixed in eduMFA >= 2.9.1 by adding validity information to the userless challenges.
Workarounds
No known workarounds besides disabling userless login altogether.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | edumfa | < 2.9.1 | 2.9.1 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-287, CWE-613- Platform
- Python (PyPI)
- Package
edumfa- Disclosed
- 18.05.2026
- Updated
- 11.10.2026 12:19
Sources and licenses
OSV / GitHub Advisory Database - GHSA-j5rm-v3vh-vx94 - CC BY 4.0
Vulnerability history: edumfa
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 4
- First → latest
- 07.2024 05.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 2
Disclosures per year
- 2024: 1
- 2025: 0
- 2026: 3
-
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.