CVE-2023-42820

JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated verification codes to be replayed, which could lead to password resets. If MFA is enabled users are not affect. Users not using local authentication are also not affected. Users are advised to upgrade to either version 2.28.19 or to 3.6.5. There are no known workarounds or this issue.

• CWE-200

• https://github.com/jumpserver/jumpserver/commit/42337f0d00b2a8d45ef063eb5b7deeef81597da5Patch
• https://github.com/jumpserver/jumpserver/security/advisories/GHSA-7prv-g565-82qpVendor Advisory
• https://github.com/jumpserver/jumpserver/commit/42337f0d00b2a8d45ef063eb5b7deeef81597da5Patch
• https://github.com/jumpserver/jumpserver/security/advisories/GHSA-7prv-g565-82qpVendor Advisory

Published

Sep 27, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-42815Kyverno is a policy engine designed for Kubernetes. A securi…5.3
• CVE-2023-42816Kyverno is a policy engine designed for Kubernetes. A securi…5.3
• CVE-2023-42817Pimcore admin-ui-classic-bundle provides a Backend UI for Pi…5.4
• CVE-2023-42818JumpServer is an open source bastion host. When users enable…9.8
• CVE-2023-42819JumpServer is an open source bastion host. Logged-in users c…8.8
• CVE-2023-4282The EmbedPress plugin for WordPress is vulnerable to unautho…4.3
• CVE-2023-42821The package `github.com/gomarkdown/markdown` is a Go library…7.5
• CVE-2023-42822xrdp is an open source remote desktop protocol server. Acces…6.5
• CVE-2023-42823The issue was resolved by sanitizing logging This issue is f…5.5
• CVE-2023-42824The issue was addressed with improved checks. This issue is …7.8
• CVE-2023-42826The issue was addressed with improved checks. This issue is …7.8
• CVE-2023-42828This issue was addressed by removing the vulnerable code. Th…7.8