ID:12588 - Exploit for Improper Authentication in ChurchCRM

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error when processing authentication requests in the /api/public/user/login endpoint. A remote attacker can bypass the 2FA and account lockout checks.

Remediation