CVE-2019-16766: 2FA bypass in wagtail-2fa through new device path
Summary
CVE-2019-16766: 2FA bypass in Wagtail through new device path. Affects wagtail-2fa versions < 1.3.0. Fixed in 1.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
wagtail-2fa is a Python package available on PyPI that provides two-factor authentication (2FA) functionality for the Wagtail CMS. It adds an extra layer of security to the login process by requiring users to provide a second form of authentication, in addition to their credentials, to access the CMS. However, a vulnerability has been discovered in versions prior to 1.3.0 that allows an attacker to bypass the 2FA check by manipulating the URL and gain unauthorized access to the CMS.
Vulnerability Detail
The vulnerability in wagtail-2fa allows an attacker who has obtained someone's login credentials to log into the CMS and bypass the 2FA check by changing the URL. By adding a new device through the manipulated URL, the attacker can gain full access to the CMS and perform unauthorized actions. This vulnerability poses a significant risk to the security and integrity of the CMS, as it allows an attacker to bypass the additional layer of protection provided by 2FA.
How To Fix
Latest published version: 1.8.0 as of 22 Oct 2026
pip install --upgrade "wagtail-2fa==1.8.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.0
This is the first release that contains the fix.
pip install --upgrade "wagtail-2fa==1.3.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is currently no known workaround for this vulnerability. It is essential to apply the provided patch by upgrading to version 1.3.0 or later to mitigate the risk of 2FA bypass.
Conclusion
The 2FA bypass vulnerability in wagtail-2fa allows an attacker to bypass the 2FA check and gain unauthorized access to the Wagtail CMS. It is crucial to upgrade to version 1.3.0 or later, which includes a patch for this vulnerability. Upgrading and properly configuring the 2FA feature will help ensure the security and integrity of the CMS. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for wagtail-2fa →
FAQ
wagtail-2fa is a Python package that adds two-factor authentication functionality to the Wagtail CMS, providing an additional layer of security to the login process.
The 2FA bypass vulnerability in wagtail-2fa allows an attacker with access to someone's login credentials to bypass the 2FA check by manipulating the URL. By changing the URL, the attacker can add a new device and gain full access to the CMS without going through the 2FA verification process.
The impact of this vulnerability is that an attacker who has obtained someone's login credentials can gain unauthorized access to the Wagtail CMS and perform actions with full privileges. This can lead to unauthorized content modification, data breaches, and other malicious activities.
Yes, this vulnerability has been patched in version 1.3.0 of wagtail-2fa. It is crucial to upgrade to this version or later to mitigate the risk of 2FA bypass.
To upgrade wagtail-2fa to the patched version (1.3.0), you can use the package manager or dependency management tool in your Python project. For example, if you are using pip, you can run the command 'pip install --upgrade wagtail-2fa==1.3.0'. Make sure to follow the appropriate upgrade process for your specific project setup.
References
Related vulnerabilities
Recent vulnerabilities recorded for wagtail-2fa.
