| Package | Affected versions | Patched versions |
|---|---|---|
| cockpit-hq/cockpit | < 2.2.2 | 2.2.2 |
| cockpit | < 2.2.2 | 2.2.2 |
Cockpit Content Platform through version 2.2.1 is vulnerable to a two-factor authentication (2FA) bypass. The 2FA secret is disclosed in a JWT token after user logs into their account, allowing an attacker to bypass the 2FA code. A patch is available on the develop branch and is expected to be part of version 2.2.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free