Authentication Bypass in Ikaros via Reused Login Temp Token

Executive Summary

Ikaros versions 1.2.0 to 1.2.5 have an authentication bypass flaw. Attackers with a valid password can skip TOTP verification by reusing a login temp token. This token can be presented as a bearer JWT, refreshed, or used with HTTP Basic login to gain full account access, including master administrator privileges.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain unauthorized access to user accounts, including administrative ones, by bypassing multi-factor authentication. This could lead to data theft, unauthorized modifications, or complete system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage due to compromised data integrity and access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Ikaros to a version beyond 1.2.5 to address the authentication bypass. Review and rotate all JWT tokens, especially temp tokens from the jwt/apply endpoint. Disable HTTP Basic login if not required and enforce TOTP verification for all accounts.

Useful 0 Not Useful 0