Missing Critical Step in Authentication in ChurchCRM - #VU129713

Detailed vulnerability description

The vulnerability allows a remote user to bypass two-factor authentication and account lockout to obtain an API key and access protected API routes.

The vulnerability exists due to missing critical steps in authentication in the public API login handler in src/api/routes/public/public-user.php when processing password-only login requests to /api/public/user/login. A remote user can send valid credentials to obtain an API key and access protected API routes.

The browser login path enforces two-factor authentication and lockout checks, but the API token authentication path does not re-check those controls, and demonstrated access included finance data.

Remediation

Sources

• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-cwp8-rm8g-q5c9
• https://github.com/ChurchCRM/CRM/commit/214694eb83778e1f5e52b3dfa2a99d0e965c1850