CVE-2024-52586: Elabftw MFA Bypass Vulnerability

CVE-2024-52586 Overview

eLabFTW is an open source electronic lab notebook used by research laboratories. CVE-2024-52586 is an authentication bypass vulnerability affecting versions 4.6.0 through 5.1.0. The flaw allows an attacker with valid credentials to bypass the built-in multifactor authentication (MFA) mechanism. An attacker who knows or guesses a user's password can complete login regardless of the MFA policy configured on the account. The issue does not affect MFA enforced by external single sign-on (SSO) providers. Maintainers advise upgrading to version 5.1.9 or later to remediate the vulnerability. This weakness is classified under [CWE-288] Authentication Bypass Using an Alternate Path or Channel.

Critical Impact
An authenticated attacker can bypass eLabFTW's native multifactor authentication and access accounts protected only by a password, undermining the second factor of trust for lab notebook data.

Affected Products

eLabFTW versions 4.6.0 through 5.1.0 (inclusive of the introduction range up to and not including 5.1.0 in advisory notation; fixed in 5.1.9)
Deployments relying on eLabFTW's built-in TOTP-based MFA
Self-hosted eLabFTW instances not fronted by SSO-enforced MFA

Discovery Timeline

2024-12-09 - CVE-2024-52586 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-52586

Vulnerability Analysis

The vulnerability lets a local authenticated attacker complete the login flow without satisfying the multifactor authentication challenge. eLabFTW's built-in MFA is intended to require a valid time-based one-time password (TOTP) after successful password validation. In affected versions, the enforcement check can be circumvented, allowing password-only authentication to succeed. Because MFA is designed to compensate for weak or compromised passwords, its bypass reduces overall account security to the strength of a single credential factor. The attack vector is local, meaning the attacker must reach the authentication interface and know or guess a valid password. The impact spans confidentiality, integrity, and availability of the affected user's lab notebook data. MFA enforced by external SSO providers is unaffected, since that flow is handled outside eLabFTW's native code path.

Root Cause

The root cause is improper enforcement of the MFA gate in eLabFTW's authentication logic between versions 4.6.0 and 5.1.0. The application accepts an authentication state without validating that the second factor requirement was met. Technical specifics are documented in the eLabFTW GitHub Security Advisory GHSA-pvxr-39g3-m28c.

Attack Vector

Exploitation requires knowledge of a valid username and password pair for a target eLabFTW account. The attacker submits credentials to the login endpoint and traverses a path that skips the MFA verification step. No user interaction is required from the legitimate account holder. The vulnerability is most impactful in environments where MFA was assumed to compensate for weak, reused, or previously breached passwords.

No verified public proof-of-concept code is available. Refer to the vendor advisory for exploitation specifics.

Detection Methods for CVE-2024-52586

Indicators of Compromise

Successful logins to eLabFTW user accounts that have MFA configured but show no corresponding TOTP validation event in application logs.
Authentication events from unusual IP addresses or user agents for accounts with active MFA enrollment.
Session creation timestamps that do not correlate with expected MFA challenge-response latency.

Detection Strategies

Audit eLabFTW authentication logs for logins to MFA-enabled accounts and confirm each session includes an MFA verification record.
Correlate web server access logs with application-level authentication events to identify sessions that bypassed the MFA endpoint.
Alert on any successful authentication to accounts flagged as MFA-enforced when the second-factor code path was not executed.

Monitoring Recommendations

Forward eLabFTW application logs and reverse proxy access logs to a centralized logging or SIEM platform for correlation.
Track failed and successful login rates per account and per source IP to identify credential-stuffing or password-guessing precursors.
Monitor for logins outside expected working hours or geographies for research staff accounts.

How to Mitigate CVE-2024-52586

Immediate Actions Required

Upgrade all eLabFTW instances to version 5.1.9 or later, as directed by the vendor advisory.
Force password resets for accounts that relied on built-in MFA as a compensating control for weak passwords.
Review authentication logs since version 4.6.0 was deployed for evidence of MFA bypass attempts.
Re-enroll users in MFA after upgrading to validate that the enforcement flow now functions correctly.

Patch Information

The fix is available in eLabFTW version 5.1.9 and later. Administrators should follow the upgrade guidance in the eLabFTW GitHub Security Advisory GHSA-pvxr-39g3-m28c.

Workarounds

Front eLabFTW with a single sign-on provider that enforces MFA externally, since SSO-based MFA is not affected by this issue.
Restrict network access to the eLabFTW authentication interface to trusted networks or VPN users until patching is complete.
Enforce strong, unique password policies and monitor for credential reuse using breach-corpus checks while the patch is applied.

bash

# Configuration example: verify installed eLabFTW version and upgrade
docker exec -it elabftw bin/console version

# Pull the patched image and recreate the container
docker pull elabftw/elabimg:latest
docker compose down
docker compose up -d

# Confirm version is 5.1.9 or later
docker exec -it elabftw bin/console version