Dashboard / CVE-2026-121531

CVE-2026-121531

LOW
INFO Priority: 0.01 BB Relevance: 54/100
Published: 2026-11-03 Modified: 2026-11-03 First seen: 2026-11-03 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: X
AT: None
VC: Low
VI: Low
VA: Low

Description

A vulnerability has been found in Umami 3.3.x/3.4.0/3.4.1. This affects an unknown part of the file src/app/api/auth/login/route.ts of the component 2FA Policy Handler. The manipulation leads to use of single-factor authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Weakness Classification (2)

Affected Software (6)

VendorProductVersion
n/a Umami 3.3.*
n/a Umami 3.4.0
n/a Umami 3.4.1
n/a Umami 3.3.*
n/a Umami 3.4.0
n/a Umami 3.4.1

References & Advisories (7)

https://vuldb.com/submit/1019994
third-party-advisory
https://vuldb.com/vuln/430290/cti
signature permissions-required

Bug Bounty Relevance

54 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

2.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.35%
Raw Score 0.003490
Percentile 29.0%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00349
2026-11-13
0.00349
2026-11-12
0.00349
2026-11-10
0.00349
2026-11-09
0.00349
2026-11-08
0.00349
2026-11-07
0.00349
2026-11-06
0.00349
2026-11-05
0.00349
2026-11-04
0.00349

Intelligence Sources

mitre ref →
nvd ref →

External Links