CVE-2020-5240: 2FA bypass through deleting devices in wagtail-2fa
Summary
CVE-2020-5240: 2FA bypass through deleting devices in wagtail-2fa. Affects wagtail-2fa versions < 1.4.1. Fixed in 1.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is wagtail-2fa, which is an open-source Python package available on PyPI. It provides two-factor authentication (2FA) functionality for the Wagtail CMS. This package allows users to add an extra layer of security to their Wagtail CMS by requiring a second form of authentication, in addition to the password, to access the system.
Vulnerability Detail
The vulnerability identified as CVE-2020-5240 allows any user with access to the CMS to view and delete other users' 2FA devices by navigating to a specific path. This vulnerability does not require any special permissions and can be exploited by any user with access to the CMS. By deleting another user's device, an attacker can disable their 2FA devices and potentially compromise their account if they can also obtain the user's password.
How To Fix
Latest published version: 1.8.0 as of 22 Oct 2026
pip install --upgrade "wagtail-2fa==1.8.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.1
This is the first release that contains the fix.
pip install --upgrade "wagtail-2fa==1.4.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Users are strongly advised to upgrade to the patched version as soon as possible.
Conclusion
The vulnerability in wagtail-2fa allows unauthorized users to view and delete other users' 2FA devices, potentially compromising their accounts. It is crucial for users to upgrade to the patched version (1.4.1) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for wagtail-2fa →
FAQ
The vulnerability allows an attacker to view and delete other users' 2FA devices, potentially compromising their accounts.
Any user with access to the CMS can exploit this vulnerability.
No, attackers do not require special permissions to exploit this vulnerability.
The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 7.6, indicating a high severity.
Yes, the vulnerability has been patched in version 1.4.1 of the wagtail-2fa package.
References
Related vulnerabilities
Recent vulnerabilities recorded for wagtail-2fa.
