CVE-2023-31140

OpenProject is open source project management software. Starting with version 7.4.0 and prior to version 12.5.4, when a user registers and confirms their first two-factor authentication (2FA) device for an account, existing logged in sessions for that user account are not terminated. Likewise, if an administrators creates a mobile phone 2FA device on behalf of a user, their existing sessions are not terminated. The issue has been resolved in OpenProject version 12.5.4 by actively terminating sessions of user accounts having registered and confirmed a 2FA device. As a workaround, users who register the first 2FA device on their account can manually log out to terminate all other active sessions. This is the default behavior of OpenProject but might be disabled through a configuration option. Double check that this option is not overridden if one plans to employ the workaround.

• CWE-613

• https://community.openproject.org/wp/48035Exploit
• https://github.com/opf/openproject/pull/12508Patch
• https://github.com/opf/openproject/security/advisories/GHSA-xfp9-qqfj-x28qMitigation, Vendor Advisory
• https://www.openproject.org/docs/release-notes/12-5-4/Mitigation, Release Notes
• https://community.openproject.org/wp/48035Exploit
• https://github.com/opf/openproject/pull/12508Patch
• https://github.com/opf/openproject/security/advisories/GHSA-xfp9-qqfj-x28qMitigation, Vendor Advisory
• https://www.openproject.org/docs/release-notes/12-5-4/Mitigation, Release Notes

Published

May 8, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-31135Dgraph is an open source distributed GraphQL database. Exist…5.5
• CVE-2023-31136PostgresNIO is a Swift client for PostgreSQL. Any user of Po…5.9
• CVE-2023-31137MaraDNS is open-source software that implements the Domain N…7.5
• CVE-2023-31138DHIS2 Core contains the service layer and Web API for DHIS2,…6.5
• CVE-2023-31139DHIS2 Core contains the service layer and Web API for DHIS2,…7.5
• CVE-2023-3114Terraform Enterprise since v202207-1 did not properly implem…7.7
• CVE-2023-31141OpenSearch is open-source software suite for search, analyti…5.9
• CVE-2023-31142Discourse is an open source discussion platform. Prior to ve…5.3
• CVE-2023-31143mage-ai is an open-source data pipeline tool for transformin…9.8
• CVE-2023-31144Craft CMS is a content management system. Starting in versio…6.1
• CVE-2023-31145Collabora Online is a collaborative online office suite base…6.1
• CVE-2023-31146Vyper is a Pythonic smart contract language for the Ethereum…9.1