CVE-2026-28510

eLabFTW is an open source electronic lab notebook. In elabftw versions through 5.4.1, the login flow did not reliably preserve the multi-factor authentication state across authentication steps. Under certain conditions, an attacker with valid primary credentials could complete authentication with an attacker-controlled TOTP secret and bypass the additional factor. This could result in unauthorized account access. This issue is fixed in version 5.4.2.

• CWE-302

• https://github.com/elabftw/elabftw/commit/8b7a575aef128870861187eaa2b2f0f08654ecf9Patch
• https://github.com/elabftw/elabftw/security/advisories/GHSA-x5wv-c9q4-fj65Mitigation, Vendor Advisory

Published

May 5, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28505Tautulli is a Python based monitoring and tracking tool for …10
• CVE-2026-28506Outline is a service that allows for collaborative documenta…4.3
• CVE-2026-28507Idno is a social publishing platform. Prior to version 1.6.4…7.2
• CVE-2026-28508Idno is a social publishing platform. Prior to version 1.6.4…8.6
• CVE-2026-28509LangBot is a global IM bot platform designed for LLMs. Prior…5.4
• CVE-2026-2851A vulnerability was determined in yeqifu warehouse up to aaf…5.3
• CVE-2026-28511eLabFTW is an open source electronic lab notebook. Prior to …4.3
• CVE-2026-28512Pocket ID is an OIDC provider that allows users to authentic…6.1
• CVE-2026-28513Pocket ID is an OIDC provider that allows users to authentic…7.1
• CVE-2026-28514Rocket.Chat is an open-source, secure, fully customizable co…9.8
• CVE-2026-28515openDCIM version 23.04, through commit 4467e9c4, contains a …8.8
• CVE-2026-28516openDCIM version 23.04, through commit 4467e9c4, contains a …8.8