Unrated

Authentication bypass in FacturaScripts two-factor validation

IdentifiersCVE-2026-47677CWE-307

CVE-2026-47677 is an authentication bypass vulnerability in FacturaScripts affecting the two-factor authentication flow. The issue resides in the login endpoint handling two-factor validation, where the application accepts TOTP verification attempts without adequately binding the request to a successfully completed primary password-authentication step. As a result, an unauthenticated attacker who knows a target user's nick can directly submit repeated TOTP guesses against the two-factor validation action. The vulnerable flow also lacks sufficient request validation and pre-verification abuse controls, enabling brute-force attempts against 2FA codes. The weakness can lead to full compromise of accounts protected by two-factor authentication, including administrative accounts.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an unauthenticated remote attacker to bypass the intended authentication sequence and obtain a valid authenticated session as the targeted user. This results in full account takeover with the victim's effective privileges, including read and write access to application data and administrative control where the compromised account has elevated permissions. The flaw can also be abused to trigger incident thresholds and cause targeted account lockout or denial of service conditions against specific users.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, restrict access to the application login interface and especially the two-factor validation endpoint using compensating network controls such as VPN-only access, IP allowlisting, reverse-proxy access controls, or temporary reduction of Internet exposure. Monitor for repeated two-factor validation requests and clusters of failed 2FA attempts indicative of brute-force activity. Where code changes are feasible, require evidence of a completed password step before processing 2FA validation, enforce CSRF checks, apply abuse-detection and rate-limiting before TOTP verification, and reduce the TOTP verification window.

Remediation

Patch, then assume compromise.

Upgrade FacturaScripts to version 2026.3 or later. The vulnerable two-factor validation flow should be corrected so that TOTP verification is only accepted after proof of a successfully completed password-authentication step, such as a short-lived post-password nonce or equivalent server-side state. The affected handler should also enforce CSRF validation and perform incident or rate-limit checks before verifying submitted TOTP codes. Reducing the TOTP verification acceptance window also lowers brute-force feasibility.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

FacturascriptsFacturascriptsapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

1 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1