2FA bypass in Wagtail through new device path
Priority MEDIUM 41CWE-290Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-290.
Summary
When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0.
Why it matters now
EPSS 0.01462 73rd percentileScored 2026-11-07
Fix Fixed wagtail-2fa (Lab Digital): 1.3.0wagtail-2fa (PyPI): 1.3.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Lab Digital | wagtail-2fa | < 1.3.0 to before 1.3.0 | 1.3.0 | Patch available | CNA |
| — | wagtail-2fa (PyPI) | before 1.3.0 | 1.3.0 | Patch available | GHSA-89px-ww3j-g2mm |
- wagtail-2fa VendorLab Digital Affected < 1.3.0 to before 1.3.0 Fixed in 1.3.0 Patch available CNA
- wagtail-2fa (PyPI) Vendor— Affected before 1.3.0 Fixed in 1.3.0 Patch available GHSA-89px-ww3j-g2mm
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:labdigital:wagtail-2fa:*:*:*:*:*:*:*:* | before 1.3.0 | Vulnerable | Lab Digital |
- cpe:2.3:a:labdigital:wagtail-2fa:*:*:*:*:*:*:*:* Versions before 1.3.0 Vulnerable ·Lab Digital
Remediation
- Fix · CNA wagtail-2fa (Lab Digital) Fixed in 1.3.0
- Fix · GHSA-89px-ww3j-g2mm wagtail-2fa (PyPI) Fixed in 1.3.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-16766
- 2026-10-03 Alias added: GHSA-89px-ww3j-g2mm
References
Patch 2
Advisory 2
More Lab Digital Wagtail-2fa vulnerabilities
- TI-2020-04296 2FA bypass through deleting devices in wagtail-2fa CVSS 3.1HIGH 8.5
Sources
- CVE-2019-16766 · CVE Program
- CVE-2019-16766 · NVD
- FIRST EPSS
- GHSA-89px-ww3j-g2mm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences