Skip to content
Fencer Vulns
high 8.7

CVE-2019-16766 json

2FA bypass in Wagtail through new device path

published 2019-11-29 6 y ago modified 2026-09-10 1 mo ago also GHSA-89px-ww3j-g2mm , PYSEC-2019-135 , EUVD-2019-0155

cvss
8.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 73%
public exploits
0
none known

Summary

When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0.

Patch / fix

  • pypi wagtail-2fa 1.3.0
  • Lab Digital wagtail-2fa 1.3.0

Exploit prediction

1.46% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N
GitHub 3.1 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
pypi wagtail-2fa
<1.3.0
1.3.0

Affected products

  • Lab Digital wagtail-2fa

Classification

Weakness
  • CWE-304 Missing Critical Step in Authentication
  • CWE-290 Authentication Bypass by Spoofing

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.