CVE-2023-45140

The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don't honor group-based JIT MFA. Establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not ask for additional factor. This abnormal behavior only applies to per-group-based JIT MFA. Other MFA setup types, such as Immediate MFA, JIT MFA on a per-plugin basis and JIT MFA on a per-account basis are not affected. This issue has been patched in version 3.14.15.

• CWE-306

• https://github.com/ovh/the-bastion/releases/tag/v3.14.15Patch
• https://github.com/ovh/the-bastion/security/advisories/GHSA-pr4q-w883-pf5xMitigation, Vendor Advisory
• https://github.com/ovh/the-bastion/releases/tag/v3.14.15Patch
• https://github.com/ovh/the-bastion/security/advisories/GHSA-pr4q-w883-pf5xMitigation, Vendor Advisory

Published

Nov 8, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-45135XWiki Platform is a generic wiki platform offering runtime s…8
• CVE-2023-45136XWiki Platform is a generic wiki platform offering runtime s…9.6
• CVE-2023-45137XWiki Platform is a generic wiki platform offering runtime s…5.4
• CVE-2023-45138Change Request is an pplication allowing users to request ch…9.6
• CVE-2023-45139fontTools is a library for manipulating fonts, written in Py…7.5
• CVE-2023-4514The Mmm Simple File List WordPress plugin through 2.3 does n…5.4
• CVE-2023-45141Fiber is an express inspired web framework written in Go. A …8.8
• CVE-2023-45142OpenTelemetry-Go Contrib is a collection of third-party pack…7.5
• CVE-2023-45143Undici is an HTTP/1.1 client written from scratch for Node.j…3.5
• CVE-2023-45144com.xwiki.identity-oauth:identity-oauth-ui is a package to a…9.6
• CVE-2023-45145Redis is an in-memory database that persists on disk. On sta…3.6
• CVE-2023-45146XXL-RPC is a high performance, distributed RPC framework. Wi…10