CVE-2026-110097: Ikaros 1.2.0 through 1.2.5 TOTP Authentication Bypass via Temp Token
Published Oct 13, 2026
·Updated
Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp token. Attackers can present the temp token from the jwt/apply endpoint as a bearer JWT, refresh it, or use HTTP Basic login to gain full account access, including the master administrator.
Affected Software
1 affected component
Ikaros Ikaros>=1.2.0<=1.2.5
Event History
Oct 13, 2026
CVE Published
via MITRE·04:53 PM
Data Sourced
via MITRE·04:53 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What must an attacker possess to exploit this issue?
The attacker needs a valid account password. They can then bypass the TOTP verification step by reusing the temporary login token.
2
Can this lead to administrative compromise?
Yes. The issue can provide full access to the affected account, including the master administrator account if its valid password is known.
3
How can the temporary token be used after it is obtained?
It can be presented as a bearer JWT, refreshed, or used with HTTP Basic login to obtain account access.