CVE-2019-16766

CVE-2019-16766 describes a critical authentication bypass vulnerability in wagtail-2fa versions prior to 1.3.0. An attacker with stolen Wagtail login credentials could bypass the two-factor authentication (2FA) check by manipulating the URL, subsequently adding a new device, and gaining full administrative access to the CMS. This vulnerability carries a CVSS score of 8.8 (HIGH), indicating a network-based attack with low complexity, requiring only low privileges, and leading to high confidentiality, integrity, and availability impacts. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.