Version‑by‑version eLabFTW (elabftw) suffered a login flaw that prevented the system from reliably carrying forward the multi‑factor authentication (MFA) status during the authentication sequence. An attacker who possessed a legitimate primary username and password could supply a malicious TOTP secret and complete the login process without presenting the second factor. The result is that the compromised account is fully authenticated under the attacker’s control, giving them full access to the user’s data. The weakness is a classic authentication bypass, formally mapped to CWE‑302.

This issue affects all eLabFTW deployments up to and including version 5.4.1. Users running any of these releases are vulnerable, while any installation on version 5.4.2 or later is not susceptible because the login logic has been corrected.

The CVSS score of 5.9 indicates moderate severity; however, because the attack requires only valid primary credentials (which the user must). The EPSS score is not available, so the current exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. In environments where MFA is heavily relied upon, the flaw represents a direct loss of that additional security layer. An attacker with the necessary credentials can effect the exploit in a single authenticated step, making the vulnerability relatively straightforward if the conditions are met.