Live › vulnerability › CVE-2026-121531
Umami analytics versions 3.3.x, 3.4.0 and 3.4.1 have a flaw in the login route that can lead to single-factor authentication even when two-factor is expected. An attacker who can reach the login endpoint may be able to sign in with only a password.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:15 UTC. All times on this page are UTC.
Teams that self-host Umami 3.3.x, 3.4.0 or 3.4.1 with user accounts exposed to the internet and two-factor enforcement turned on. The flaw sits in the login route's 2FA policy handler at src/app/api/auth/login/route.ts. Hosted or managed Umami instances and versions outside the listed range are not described as affected.
No product ranges from the sources yet.
3.3.x, 3.4.0 or 3.4.1No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in Umami 3.3.x/3.4.0/3.4.1. This affects an unknown part of the file src/app/api/auth/login/route.ts of the component 2FA Policy Handler. The manipulation leads to use of single-factor authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-121531")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.