{"action":"Upgrade ralffreit/mfa-email to 1.0.7 or later.","affected":[{"fixed":"1.0.7","introduced":"0"},{"fixed":"2.0.1","introduced":"2.0.0"}],"component":"ralffreit/mfa-email","cve_ids":["CVE-2026-4208"],"ecosystem":"Packagist","epss":0.00266,"exploited":false,"fixed_versions":["1.0.7","2.0.1"],"ghsa_id":"GHSA-29r8-gvx4-r9w3","id":"tcs_01M5KERSWVF5NR8GJHNMSV9SAE","modified_at":"2026-05-05T15:55:58.462567Z","published_at":"2026-03-17T09:31:28Z","references":["https://osv.dev/vulnerability/GHSA-29r8-gvx4-r9w3","https://nvd.nist.gov/vuln/detail/CVE-2026-4208","https://github.com/MrSilaz/mfa_email/commit/0bb7e85b236a5232f7b092915453dd7c3da48f12","https://github.com/MrSilaz/mfa_email","https://github.com/MrSilaz/mfa_email/releases/tag/v1.0.7","https://github.com/MrSilaz/mfa_email/releases/tag/v2.0.1","https://typo3.org/security/advisory/typo3-ext-sa-2026-007"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-29r8-gvx4-r9w3","url":"https://osv.dev/vulnerability/GHSA-29r8-gvx4-r9w3"}],"summary":"Authentication Bypass in extension \"E-Mail MFA Provider\" (mfa_email)"}