{"id":"CVE-2026-110097","summary":"Ikaros 1.2.0 through 1.2.5 TOTP Authentication Bypass via Temp Token","details":"Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp token. Attackers can present the temp token from the jwt/apply endpoint as a bearer JWT, refresh it, or use HTTP Basic login to gain full account access, including the master administrator.","modified":"2026-10-15T07:07:24.388855869Z","published":"2026-10-13T16:53:02.487Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110097.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-287"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110097.json"},{"type":"ADVISORY","url":"https://github.com/ikaros-dev/ikaros/releases/tag/v1.2.5"},{"type":"ADVISORY","url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ikaros-2fa-bypass-temp-token"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110097"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/ikaros-1.2.0-through-1.2.5-totp-authentication-bypass-via-temp-token"},{"type":"PACKAGE","url":"https://github.com/ikaros-dev/ikaros"},{"type":"ARTICLE","url":"https://github.com/ikaros-dev/ikaros/blob/v1.2.5/server/src/main/java/run/ikaros/server/security/SecurityEndpoint.java#L80-L118"},{"type":"ARTICLE","url":"https://github.com/ikaros-dev/ikaros/blob/v1.2.5/server/src/main/java/run/ikaros/server/security/authentication/jwt/JwtAuthenticationFilter.java#L30-L46"},{"type":"ARTICLE","url":"https://github.com/ikaros-dev/ikaros/blob/v1.2.5/server/src/main/java/run/ikaros/server/security/authentication/jwt/JwtAuthenticationProvider.java#L57-L112"},{"type":"EVIDENCE","url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/cve-2026-110097-ikaros-2fa-bypass-temp-token"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ikaros-dev/ikaros","events":[{"introduced":"633ca04aba8718b29822201c972f1ab8320a0034"},{"fixed":"ef60006b873823de50ddd019734680167b66329c"}],"database_specific":{"extracted_events":[{"introduced":"1.2.0"},{"last_affected":"1.2.5"},{"fixed":"1.2.5"}],"source":["AFFECTED_FIELD","DESCRIPTION","REFERENCES"]}}],"versions":["v1.2.4","v1.2.3","v1.2.1","v1.2.0"],"database_specific":{"vanir_signatures_modified":"2026-10-15T07:07:24Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110097.json","vanir_signatures":[{"digest":{"line_hashes":["263017991692966476205911725738495553520","154469040511565731383333764564411127472","160166275333526094690898730348674687453","306749579562612480380347708210211198563","191199919101758226318473557779460771588","9233552874762508146810368819984157304","267883416682807188411328348332188850952"],"threshold":0.9},"id":"CVE-2026-110097-58b9f5c4","signature_type":"Line","signature_version":"v1","source":"https://github.com/ikaros-dev/ikaros/commit/ef60006b873823de50ddd019734680167b66329c","target":{"file":"server/src/main/java/run/ikaros/server/store/repository/AttachmentRepository.java"},"deprecated":false},{"id":"CVE-2026-110097-5936f5d4","signature_type":"Function","signature_version":"v1","source":"https://github.com/ikaros-dev/ikaros/commit/ef60006b873823de50ddd019734680167b66329c","target":{"file":"server/src/main/java/run/ikaros/server/core/attachment/service/impl/AttachmentServiceImpl.java","function":"removeByTypeAndParentIdAndName"},"deprecated":false,"digest":{"function_hash":"213060246009107246966997099967463026135","length":403}},{"signature_version":"v1","source":"https://github.com/ikaros-dev/ikaros/commit/ef60006b873823de50ddd019734680167b66329c","target":{"function":"saveEntity","file":"server/src/main/java/run/ikaros/server/core/attachment/service/impl/AttachmentServiceImpl.java"},"deprecated":false,"digest":{"function_hash":"235755052348457700233951919710118147575","length":683},"id":"CVE-2026-110097-b021724c","signature_type":"Function"},{"digest":{"threshold":0.9,"line_hashes":["123274023356754505420946323006333197552","231181225178862858250289223479099915862","97466500712337543796245117627701574073","213161208219763291279672888787124579621","279985266870389274397067666843709981117","308000178907292535908409878836526911987","226399627518534144138624197448445863260","314137569140403512127431540278111269558","131432681049098149833272385486918011820","8804704084018842048348347476530785122","23357776841976613251579523270301184919","243905342183117801988898189309285407270","250524121416579418722609651818877370175","269929596175206520090260375827141612447","12983616814293751215753504629616369605","98847692349612345130131112792206629611","201841343175238993969734662279816621459","137298480817351590313292605181578857164","131071077416075488868946974013754168275","11480895349006200681841529635278293041","30264063939365906507928043279277027139","307970426608012515578437675800364182854","307094647428641576346997787528352756978","296685852313678411056972883291578897176","188379946790663958525831989202755189609","231842762358205789348398060469104898189","222967417872390699931565904336907994417","130916974715271652078614967108624919991","242434518318341526837658984690979195212","198807144246984868369957631448152409565","313677545900624992027823446264034293037","336204417605408060264824697562326779515","215611671611023402190274684915365611876","296055379783397003505351019870673390005","321964848535656791711161015522790813113","233175915974255094949857494303786213340"]},"id":"CVE-2026-110097-ef001c48","signature_type":"Line","signature_version":"v1","source":"https://github.com/ikaros-dev/ikaros/commit/ef60006b873823de50ddd019734680167b66329c","target":{"file":"server/src/main/java/run/ikaros/server/core/attachment/service/impl/AttachmentServiceImpl.java"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}