Read the docs
TI-2021-18010 Aliases CVE-2021-41171

Bypass bruteforce protection on login form in elabftw

Priority MEDIUM 42CWE-307Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-307.

Summary

eLabFTW is an open source electronic lab notebook manager for research teams. In versions of eLabFTW before 4.1.0, it allows attackers to bypass a brute-force protection mechanism by using many different forged PHPSESSID values in HTTP Cookie header. This issue has been addressed by implementing brute force login protection, as recommended by Owasp with Device Cookies. This mechanism will not impact users and will effectively thwart any brute-force attempts at guessing passwords. The only correct way to address this is to upgrade to version 4.1.0. Adding rate limitation upstream of the eLabFTW service is of course a valid option, with or without upgrading.

Why it matters now

EPSS 0.01945 80th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed elabftw (elabftw): 4.1.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
elabftwelabftwbefore 4.1.04.1.0Patch availableCNA
  • elabftw Vendorelabftw Affected before 4.1.0 Fixed in 4.1.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:elabftw:elabftw:*:*:*:*:*:*:*:*before 4.1.0Vulnerableelabftw
  • cpe:2.3:a:elabftw:elabftw:*:*:*:*:*:*:*:* Versions before 4.1.0 Vulnerable ·elabftw

Remediation

  • Fix · CNA elabftw (elabftw) Fixed in 4.1.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41171

References

Exploit 1

Patch 1

Advisory 3

  • TI-2019-09101 eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the… CVSS 3.0HIGH 8.8
  • TI-2022-13053 Privilege escalation from administrator in eLabFTW CVSS 3.1HIGH 7.2
  • TI-2021-19640 Incorrect Authentication in elabftw CVSS 3.1CRITICAL 9.8
  • TI-2025-18875 Incorrect input validation could allow an authenticated user to read sensitive information CVSS 3.1HIGH 8.8
  • TI-2021-19639 Account takeover in eLabFTW CVSS 3.1HIGH 8.8
  • TI-2024-30457 eLabFTW contains a direct and indirect information disclosure CVSS 3.1HIGH 7.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences