Cloudanix VulnDB

GHSA-qq2p-4282-cfc5

High · 7.1

eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage

CVSS

7.1

EPSS

—

Published

May 18, 2026

CISA due date

—

The record

For deployments using MySQL or MariaDB < 11.6.2 (or newer with innodb_snapshot_isolation=off) reusage of token values might be possible due to faulty transaction isolation inside the database. Exploiting this requires racing this transaction. Affected are all tokentypes whose values are only supposed to be used once, for example TOTP, HOTP and likely also WebAuthN.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities