Read the docs
TI-2021-10669 Aliases CVE-2021-30120GHSA-r6j9-rwx4-qcj3

2FA bypass in Kaseya VSA <= v9.5.6

Priority CRITICAL 100CWE-669Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed description --- During the login process, after the user authenticates with username and password, the server sends a response to the client with the booleans MFARequired and MFAEnroled. If the attacker has obtained a password of a user and used an intercepting proxy (e.g. Burp Suite) to change the value of MFARequered from True to False, there is no prompt for the second factor, but the user is still logged in.

Why it matters now

Exploitation Active CISA SSVC · not in CISA KEV
EPSS 0.05701 93rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kaseya:vsa:*:*:*:*:-:*:*:*up to 9.5.6VulnerableKaseya
  • cpe:2.3:a:kaseya:vsa:*:*:*:*:-:*:*:* Versions up to 9.5.6 Vulnerable ·Kaseya

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-30120
  2. 2026-10-03 Alias added: GHSA-r6j9-rwx4-qcj3

References

Patch 1

Advisory 2

  • TI-2021-10668 Authenticated Authenticated reflective XSS in Kaseya VSA <= v9.5.6 CVSS 3.1MEDIUM 5.4
  • TI-2021-10666 Authenticated SQL injection in Kaseya VSA < v9.5.6 CVSS 3.1CRITICAL 9.8
  • TI-2021-10667 Unauthenticated Remote Code Execution in Kaseya VSA < v9.5.5 CVSS 3.1CRITICAL 9.8
  • TI-2021-10736 Unauthenticated XML External Entity vulnerability in Kaseya VSA < v9.5.6 CVSS 3.1HIGH 7.5
  • TI-2021-10670 (Semi-)Authenticated local file inclusion in Kaseya VSA < v9.5.6 CVSS 3.1MEDIUM 6.5
  • TI-2019-10812 An issue was discovered in Kaseya VSA RMM through 9.5.0.22. CVSS 3.1MEDIUM 6.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences