CVE-2022-42731

CVE-2022-42731 is a replay attack vulnerability in django-mfa2 versions before 2.5.1 and 2.6.x before 2.6.1, specifically within the mfa/FIDO2.py component. This flaw allows an attacker to register an unauthorized device for a legitimate user because the FIDO2 device registration challenge is not invalidated after its initial use. Rated with a CVSS score of 7.5 (HIGH), this vulnerability has a network-based attack vector with low complexity, requiring no user interaction, and can lead to high integrity impact by allowing unauthorized device registration. While the EPSS score is low, indicating a low probability of exploitation, the FAUCET Risk Score is 48/100. Currently, there is no evidence of active exploitation, and no public exploit code is available for Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, with only one mention and one article referencing the CVE, suggesting limited public awareness or immediate threat.