CVE-2019-16766: Vulnerability in wagtail-2fa Allows Bypassing 2FA Check
Summary
CVE-2019-16766: When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. Affects wagtail-2fa across 3 version ranges.
< 1.3.0
< 13b12995d35b566df08a17257a23863ab6efb0ca
< a6711b29711729005770ff481b22675b35ff5c81
Fixed in 13b12995d35b566df08a17257a23863ab6efb0ca. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
wagtail-2fa is a package available on PyPI that provides two-factor authentication (2FA) functionality for the Wagtail CMS. It adds an extra layer of security to the login process by requiring users to provide a second form of authentication, in addition to their credentials, to access the CMS. This package is widely used by Wagtail CMS users to enhance the security of their websites.
Vulnerability Detail
The vulnerability identified as CVE-2019-16766 in wagtail-2fa allows an attacker who gains access to someone's Wagtail login credentials to bypass the 2FA check and gain unauthorized access to the CMS. By changing the URL after logging in with the stolen credentials, the attacker can bypass the 2FA verification process. Once inside the CMS, the attacker can add a new device and gain full access to the CMS, potentially compromising sensitive information and performing malicious actions. This vulnerability was patched in version 1.3.0 of wagtail-2fa.
How To Fix
Latest published version: 1.8.0 as of 22 Oct 2026
pip install --upgrade "wagtail-2fa==1.8.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
13b12995d35b566df08a17257a23863ab6efb0ca
This is the first release that contains the fix.
pip install --upgrade "wagtail-2fa==13b12995d35b566df08a17257a23863ab6efb0ca"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in wagtail-2fa (CVE-2019-16766) allows an attacker with stolen login credentials to bypass the 2FA check and gain unauthorized access to the CMS. To mitigate this vulnerability, users should upgrade to version 1.3.0 or later of wagtail-2fa. This update includes the necessary security patches to prevent the bypass of the 2FA check. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for wagtail-2fa →
FAQ
wagtail-2fa is a package that provides two-factor authentication functionality for the Wagtail CMS, adding an extra layer of security to the login process.
The vulnerability allows an attacker with stolen login credentials to bypass the 2FA check by changing the URL after logging in. This grants the attacker unauthorized access to the CMS.
By bypassing the 2FA check, the attacker can add a new device and gain full access to the CMS. This can lead to unauthorized access to sensitive information and potential malicious actions.
Yes, the vulnerability has been patched in version 1.3.0 of wagtail-2fa. Users are advised to upgrade to this version or later to ensure they are protected.
To update wagtail-2fa to the latest version, run the command 'pip install --upgrade wagtail-2fa'. This will install the latest version of the package with the necessary security patches.
References
Related vulnerabilities
Recent vulnerabilities recorded for wagtail-2fa.
