{"id":"GHSA-j5rm-v3vh-vx94","aliases":[],"url":"https://o3.security/vulnerability/GHSA-j5rm-v3vh-vx94","summary":"eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges ","details":"### Impact\nIn eduMFA < 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire\n\n### Patches\nFixed in eduMFA >= 2.9.1 by adding validity information to the userless challenges.\n\n### Workarounds\nNo known workarounds besides disabling userless login altogether.","published":"2026-05-18T15:37:00Z","modified":"2026-05-18T15:48:04.309551Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"edumfa","fixedVersion":"2.9.1"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/eduMFA/eduMFA/security/advisories/GHSA-j5rm-v3vh-vx94"},{"type":"PACKAGE","url":"https://github.com/eduMFA/eduMFA"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-05-18T15:48:04.309551Z"}}