eLabFTW Multi-Factor Authentication Bypass Vulnerability

A vulnerability in eLabFTW, an open-source electronic lab notebook, allows for bypassing multi-factor authentication (MFA) under certain conditions. In versions through 5.4.1, the login process did not consistently maintain the MFA state across different authentication steps. This flaw enabled an attacker with valid primary credentials to complete the login process using a manipulated TOTP secret, thereby circumventing the additional authentication factor and gaining unauthorized access to the account.

Impact

Exploiting this vulnerability could lead to unauthorized access to user accounts by allowing attackers to bypass multi-factor authentication, weakening the security intended by this feature.

Remediation

Users are advised to upgrade to eLabFTW version 5.4.2. As a temporary measure, rotate credentials for affected accounts and monitor authentication events closely.