UpHeron
All vulnerabilities

Servers and applications

CVE-2023-31140

User sessions not terminated after activation of 2FA

Severity
Medium 6.5
Published
2 May 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
12.5.4
Also known as
GHSA-xfp9-qqfj-x28q
Sources
NVD, Project advisories (GitHub)

Description

OpenProject is open source project management software. Starting with version 7.4.0 and prior to version 12.5.4, when a user registers and confirms their first two-factor authentication (2FA) device for an account, existing logged in sessions for that user account are not terminated. Likewise, if an administrators creates a mobile phone 2FA device on behalf of a user, their existing sessions are…

Affected software

SoftwareAffected versions
OpenProjectServers and applications · cpe:a:openproject:openproject
  • From 7.4.0 before 12.5.4
OpenProjectServers and applications · github:opf/openproject
  • From 7.4.0 before 12.5.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-31140
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-31140
  • GitHub Advisory Database https://github.com/advisories/GHSA-xfp9-qqfj-x28q
  • github.com https://github.com/opf/openproject/security/advisories/GHSA-xfp9-qqfj-x28q