Nagios Fusion Two-Factor Authentication Brute-Force Bypass Vulnerability

A brute-force bypass vulnerability in the Two-Factor Authentication (2FA) implementation has been identified in Nagios Fusion versions prior to 2024R2.1. The application failed to properly enforce rate limiting or account lockout for repeated failed 2FA verification attempts. This oversight allowed remote attackers to repeatedly attempt second-factor codes for targeted accounts, potentially leading to unauthorized access.

Impact

Exploitation of this vulnerability could allow an attacker to bypass Two-Factor Authentication and gain unauthorized access to accounts protected by 2FA.

Remediation

Users are advised to update Nagios Fusion to version 2024R2.1 or later.