5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-40178

CVE-2026-40178: ajenti.plugin.core has race conditions in 2FA

Impact

If the 2FA was activated, it was possible during a short moment after the authentication of an user to bypass its authentication.

Patches

This is fixed in the version 0.112. Users should upgrade to this version as soon as possible.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-40178

CVE-2026-40178:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ajenti.plugin.core	pip	<= 0.111	0.112

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a race condition within the two-factor authentication (2FA) process of the Ajenti core plugin. The analysis of the plugins/core/views/api.py file revealed that the Handler.handle_api_auth method is responsible for the authentication flow. Specifically, within this method, the logic for handling Time-based One-Time Passwords (TOTP) contains a critical flaw. The code initiates an asynchronous TOTP verification and then explicitly waits for a fixed duration of 0.3 seconds (gevent.sleep(0.3)) before checking the outcome. This creates a predictable time window where the authentication result is pending, making the system susceptible to a race condition. An attacker could exploit this delay to bypass the 2FA mechanism. The vulnerable function is Handler.handle_api_auth as it contains the flawed logic that directly leads to the race condition.

Vulnerable functions

Handler.handle_api_auth

plugins/core/views/api.py

The function `handle_api_auth` contains a race condition in its two-factor authentication (2FA) logic. When the `mode` is 'totp', the function initiates a verification of the one-time password in a background worker and then pauses execution for 0.3 seconds using `gevent.sleep(0.3)`. After the pause, it checks a shared variable for the result of the verification. This sleep creates a time window during which an attacker could potentially manipulate the authentication state or exploit the delay to bypass the 2FA check. The use of a fixed-time sleep to wait for an asynchronous operation in a security-critical function is the root cause of the race condition.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.