What is GHSA-3mcx-6wxm-qr8v?

GHSA-3mcx-6wxm-qr8v is a security advisory published by GitHub Security Advisories with Critical severity. ajenti.plugin.core has password bypass when 2FA is activated

Which CVE IDs does GHSA-3mcx-6wxm-qr8v cover?

GHSA-3mcx-6wxm-qr8v covers the following CVE IDs: CVE-2026-40177. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3mcx-6wxm-qr8v?

GHSA-3mcx-6wxm-qr8v has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-3mcx-6wxm-qr8v?

GHSA-3mcx-6wxm-qr8v affects 1 product, including: pip/ajenti.plugin.core:\u003c 0.112.

GHSA-3mcx-6wxm-qr8vCriticalCVSS 7.5

ajenti.plugin.core has password bypass when 2FA is activated

Vendor

GitHub Security Advisories

Published

April 10, 2026

Last Modified

April 24, 2026

🔗 CVE IDs covered (1)

CVE-2026-40177 →

📋 Description

Impact

If the 2FA was activated, it was possible to bypass the password authentication

Patches

This is fixed in the version 0.112. Users should upgrade to this version as soon as possible.

🎯 Affected products1

pip/ajenti.plugin.core:< 0.112

🔗 References (3)

https://github.com/ajenti/ajenti/security/advisories/GHSA-3mcx-6wxm-qr8v
https://nvd.nist.gov/vuln/detail/CVE-2026-40177
https://github.com/advisories/GHSA-3mcx-6wxm-qr8v