{"id":"CVE-2019-16766","aliases":["GHSA-89px-ww3j-g2mm","PYSEC-2019-135"],"title":"2FA bypass in Wagtail through new device path","summary":"2FA bypass in Wagtail through new device path","severity":"high","cvss":8.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","vendor":"wagtail-2fa","product":"wagtail-2fa","ecosystem":"pip","affected":["wagtail-2fa < 1.3.0"],"patched":["wagtail-2fa 1.3.0"],"published":"2019-11-29","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:24.668776466Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-89px-ww3j-g2mm","references":[{"url":"https://github.com/labd/wagtail-2fa/security/advisories/GHSA-89px-ww3j-g2mm"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16766"},{"url":"https://github.com/labd/wagtail-2fa/commit/13b12995d35b566df08a17257a23863ab6efb0ca"},{"url":"https://github.com/labd/wagtail-2fa/commit/a6711b29711729005770ff481b22675b35ff5c81"},{"url":"https://github.com/labd/wagtail-2fa"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/wagtail-2fa/PYSEC-2019-135.yaml"}],"tags":["osv","pip"],"epss":0.01462,"epssPercentile":0.72445,"ingestedAt":"2026-09-12T03:13:01.676Z","slug":"CVE-2019-16766","body":"## Overview\n\n## 2FA bypass through new device path\n\n### Impact\nIf someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS.\n\n### Patches\nThis problem has been patched in version 1.3.0.\n\n### Workarounds\nThere is no workaround at the moment.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [github.com/labd/wagtail-2fa](https://github.com/labd/wagtail-2fa)\n* Email us at [security@labdigital.nl](mailto:security@labdigital.nl)\n\n## Affected packages\n\n- `wagtail-2fa < 1.3.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `wagtail-2fa 1.3.0`","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":47.8,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}