CVE-2023-40260

Summary

CVE-2023-40260 is a cybersecurity vulnerability affecting EmpowerID before version 7.205.0.1. An attacker who knows a user's username and password can bypass the multi-factor authentication (MFA) requirement. By changing the account's email address, the attacker can receive MFA codes sent to the new email address, allowing unauthorized access to the affected account. This bypass occurs even when the first factor (username and password) alone should not be sufficient for login. This vulnerability differs from CVE-2023-4177, which deals with an unknown processing issue in the Multi-Factor Authentication Code Handler.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.