NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐍 PyPI
Not in CISA KEV

eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusageGHSA-qq2p-4282-cfc5

GHSA-qq2p-4282-cfc5 is a security vulnerability in edumfa. A fix is available for edumfa — see the affected versions and patch details below.

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of May 18, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🐍edumfa

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Impact

For deployments using MySQL or MariaDB < 11.6.2 (or newer with innodb_snapshot_isolation=off) reusage of token values might be possible due to faulty transaction isolation inside the database. Exploiting this requires racing this transaction. Affected are all tokentypes whose values are only supposed to be used once, for example TOTP, HOTP and likely also WebAuthN.

Affected Combinations:

  • MySQL (any version)
  • MariaDB with innodb_snapshot_isolation=OFF
    • innodb_snapshot_isolation was introduced in: MariaDB 10.6.18, MariaDB 10.11.8, MariaDB 11.0.6, MariaDB 11.1.5, MariaDB 11.2.4, MariaDB 11.4.2 with default OFF, can be turned ON as a workaround
    • for MariaDB >= 11.6.2 the default is ON, which is not affected
  • Same rules applies for Galera with underlying MariaDB

Patches

Fixed in version 2.9.1 by locking rows prior to write with SELECT FOR UPDATE.

Workarounds

Set innodb_snapshot_isolation to ON (default in MariaDB >= 11.6.2, e.g packaged in Debian 13).

Resources

https://mariadb.com/resources/blog/isolation-level-violation-testing-and-debugging-in-mariadb/

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPIedumfaall versions2.9.1pip install --upgrade 'edumfa==2.9.1'

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for edumfa, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update edumfa to 2.9.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-qq2p-4282-cfc5 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact For deployments using MySQL or MariaDB < 11.6.2 (or newer with innodb_snapshot_isolation=off) reusage of token values might be possible due to faulty transaction isolation inside the database. Exploiting this requires racing this transaction. Affected are all tokentypes whose values are only supposed to be used once, for example TOTP, HOTP and likely also WebAuthN. #### Affected Combinations: - MySQL (any version) - MariaDB with innodb_snapshot_isolation=OFF - innodb_snapshot_isolation was introduced in: MariaDB 10.6.18, MariaDB 10.11.8, MariaDB 11.0.6, MariaDB 11.1.5, MariaDB
O3 Security · Impact-Aware SCA

Is GHSA-qq2p-4282-cfc5 in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
eduMFA: Incorrect InnoDB snapshot isolation possibly…