{"id":"CVE-2026-121531","kind":"vulnerability","aliases":["CVE-2026-121531"],"related":[],"title":"Umami: login route can skip two-factor authentication under certain conditions","description":"A vulnerability has been found in Umami 3.3.x/3.4.0/3.4.1. This affects an unknown part of the file src/app/api/auth/login/route.ts of the component 2FA Policy Handler. The manipulation leads to use of single-factor authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Umami analytics versions 3.3.x, 3.4.0 and 3.4.1 have a flaw in the login route that can lead to single-factor authentication even when two-factor is expected. An attacker who can reach the login endpoint may be able to sign in with only a password.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["analytics","package","self-hosted","umami"],"not_affected_if":["managed-hosting","two-factor-not-enforced"],"how_to_check":"- Check the installed Umami version in package.json or the deployed image tag, looking for `3.3.x`, `3.4.0` or `3.4.1`\n- Review whether two-factor authentication is enforced for your Umami accounts (unknown from sources how the policy is configured)","fix":null,"status":"open","published_at":"2026-11-03T22:19:46+00:00","first_seen_at":"2026-11-03T23:15:09+00:00","triaged_at":"2026-11-03T23:16:15+00:00","updated_at":"2026-11-03T23:16:15+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T23:16:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Umami: login route can skip two-factor authentication under certain conditions","impact":"medium","summary":"Umami analytics versions 3.3.x, 3.4.0 and 3.4.1 have a flaw in the login route that can lead to single-factor authentication even when two-factor is expected. An attacker who can reach the login endpoint may be able to sign in with only a password.","audience":"businesses","category":"package","nicknames":[],"who_cares":["umami","self-hosted","analytics"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker logs in with password only, bypassing second factor","analyst_note":"Confirm the fixed version and whether 2FA policy enforcement is default-on; check the vendor advisory linked on github.com.","how_to_check":"- Check the installed Umami version in package.json or the deployed image tag, looking for `3.3.x`, `3.4.0` or `3.4.1`\n- Review whether two-factor authentication is enforced for your Umami accounts (unknown from sources how the policy is configured)","plain_action":"","needs_analyst":true,"not_affected_if":["managed-hosting","two-factor-not-enforced"],"who_is_affected":"Teams that self-host Umami 3.3.x, 3.4.0 or 3.4.1 with user accounts exposed to the internet and two-factor enforcement turned on. The flaw sits in the login route's 2FA policy handler at src/app/api/auth/login/route.ts. Hosted or managed Umami instances and versions outside the listed range are not described as affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000716,"input_tokens":4181,"output_tokens":596,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121531':15A,18A '-2026':14A,17A '2fa':94C '3.3':28B,80C '3.4.0':30B '3.4.1':32B 'abl':65B 'affect':83C 'analyt':19B,26B 'attack':56B,113C 'authent':9A,47B,106C 'certain':11A 'compon':93C 'condit':12A 'contact':130C 'cve':13A,16A 'disclos':119C 'disclosur':134C 'earli':131C 'endpoint':62B 'even':48B 'expect':54B 'exploit':116C 'factor':8A,46B,52B,105C 'file':89C 'flaw':35B 'found':77C 'handler':96C 'host':23B 'initi':111C 'lead':42B,99C 'login':2A,38B,61B 'manipul':98C 'may':63B,124C 'packag':20B 'part':86C 'password':72B 'polici':95C 'possibl':109C 'public':122C 'reach':59B 'remot':114C 'respond':138C 'rout':3A,39B 'self':22B 'self-host':21B 'sign':67B 'singl':45B,104C 'single-factor':44B,103C 'skip':5A 'src/app/api/auth/login/route.ts':90C 'two':7A,51B 'two-factor':6A,50B 'umami':1A,24B,25B,79C 'unknown':85C 'use':101C,126C 'vendor':128C 'version':27B 'vulner':74C 'way':141C 'x':29B 'x/3.4.0/3.4.1':81C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Umami 3.3.x, 3.4.0 or 3.4.1 with user accounts exposed to the internet and two-factor enforcement turned on. The flaw sits in the login route's 2FA policy handler at src/app/api/auth/login/route.ts. Hosted or managed Umami instances and versions outside the listed range are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["analytics","medium","package","selfhosted","umami"],"campaign_type":null,"first_public_at":"2026-11-03T22:19:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121531","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121531","severity":null,"published_at":"2026-11-03T22:19:46+00:00","modified_at":"2026-11-03T22:19:46+00:00","first_seen_at":"2026-11-03T23:15:09+00:00","fetched_at":"2026-11-03T23:15:09+00:00","note":null}],"documents":[{"id":61391,"url":"https://github.com/umami-software/umami/security/advisories/GHSA-29fx-pxjg-35rm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}