CVE-2026-121531

The record

A vulnerability has been found in Umami 3.3.x/3.4.0/3.4.1. This affects an unknown part of the file src/app/api/auth/login/route.ts of the component 2FA Policy Handler. The manipulation leads to use of single-factor authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected packages

Related vulnerabilities

• CVE-2026-120574 The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in… CWE-287
• CVE-2026-120538 The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass… CWE-287
• CVE-2026-58915 A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD)… CWE-287
• CVE-2026-120447 HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerability that allows… CWE-287
• CVE-2026-120278 A vulnerability was detected in WAVLINK WN536AX6-A V260507_2.0.0. CWE-287
• CVE-2026-120263 When `[oauth2_client].ACCOUNT_LINKING` is set to `auto` (not the default) and… CWE-287
• CVE-2026-120191 A weakness has been identified in Presenton up to 0.9.11-beta. CWE-287
• CVE-2026-119096 The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication… CWE-287