Skip to content

← Public intelligence

PyPI package

ajenti-plugin-core

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.9PyPIAmendedPublished

    ajenti.plugin.core has race conditions in 2FA

    CVE-2026-40178 · GHSA-8647-755q-fw9p

    Affected
    • PyPI ajenti-plugin-core <= 0.111
    Fixed in
    0.112· Vendor fix available
    Issue
    Impact If the 2FA was activated, it was possible during a short moment after the authentication of an user to bypass its authentication. Patches This is fixed in the version 0.112. Users should upgrade to this version as soon as possible.

    Recommended action: Upgrade to 0.112 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →
  2. Critical, CVSS 9.1PyPIAmendedPublished

    ajenti.plugin.core has password bypass when 2FA is activated

    CVE-2026-40177 · GHSA-3mcx-6wxm-qr8v

    Affected
    • PyPI ajenti-plugin-core < 0.112
    Fixed in
    0.112· Vendor fix available
    Issue
    Impact If the 2FA was activated, it was possible to bypass the password authentication Patches This is fixed in the version 0.112. Users should upgrade to this version as soon as possible.

    Recommended action: Upgrade to 0.112 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →