Multi Factor Authentication Token Improperly Validated On User Login
Priority MEDIUM 45CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.
Summary
RATCF is an open-source framework for hosting Cyber-Security Capture the Flag events. In affected versions of RATCF users with multi factor authentication enabled are able to log in without a valid token. This is fixed in commit cebb67b.
Why it matters now
EPSS 0.01621 76th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ractf | core | >c57a4d186bfc586ad3edfe4dcba9f11efbf22f09, < cebb67bd16a8296121201805332365ffccb29638 | — | No fix listed | CNA |
- core Vendorractf Affected >c57a4d186bfc586ad3edfe4dcba9f11efbf22f09, < cebb67bd16a8296121201805332365ffccb29638 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-21329
References
Patch 3
- https://github.com/ractf/core/security/advisories/GHSA-fw57-f7mq-9q85
- https://github.com/ractf/core/commit/c57a4d186bfc586ad3edfe4dcba9f11efbf22f09#diff-60c444c47c061306f2dff5bf97c07810f40f949a8e94ecbb609b6b29364c8642R130-R152
- https://github.com/ractf/core/commit/cebb67bd16a8296121201805332365ffccb29638
More ractf vulnerabilities
- TI-2020-12007 Sensitive data exposure in RACTF CVSS 3.1HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences