CVE-2026-121531

Name of the Vulnerable Software and Affected Versions Umami versions 3.3.x through 3.4.1

Description An issue exists in the 2FA Policy Handler component within the file src/app/api/auth/login/route.ts at the '/api/auth/login' endpoint. Remote manipulation of this component allows an attacker to bypass two-factor authentication and force the use of single-factor authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.