Ajenti’s core plugin prior to version 0.112 allowed an attacker to bypass the password check when two‑factor authentication was active. The flaw permits an attacker to gain entry to the administrative interface without legitimate credentials, exposing the system to full compromise. This vulnerability is a classic example of an authentication failure (CWE-287).

All Ajenti installations running any version older than 0.112 are vulnerable. The flaw resides in the plugin that manages core authentication functionality, so any deployment of that plugin before the update is affected.

The CVSS score of 9.3 indicates a high severity risk. The EPSS score of < 1% indicates a low likelihood of exploitation. Although explicit exploitation metrics aren’t provided, the vulnerability’s nature suggests it can be exploited remotely through the web interface where username and password are submitted. It is not listed in the CISA Known Exploited Vulnerabilities catalog, but the absence of mitigations and the high score imply a significant threat. Attackers would need only to trigger the login flow with two‑factor enabled; the process is likely straightforward and does not require privileged access to the host.