CVE-2026-40178

VULNERABILITY OVERVIEW CVE-2026-40178 is an authentication bypass vulnerability in Ajenti's core plugin (ajenti.plugin.core) affecting versions prior to 0.112. The flaw exploits a brief window of time immediately following user authentication when two-factor authentication (2FA) is enabled, allowing attackers to circumvent the secondary authentication requirement. The vulnerability was remediated in version 0.112. SEVERITY ASSESSMENT The vulnerability carries a CVSS v3.1 score of 5.9 (MEDIUM severity) with a network-based attack vector requiring high attack complexity and no user interaction. The impact is limited to integrity compromise with no confidentiality or availability impact. The EPSS score of 0.0002 indicates minimal real-world exploitation probability relative to other CVEs, and the FAUCET Risk Score of 43.0/100 reflects moderate concern. EXPLOITATION STATUS There is no evidence of active exploitation or public exploit code availability. The vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on security hotlists. These factors, combined with the low EPSS score, suggest limited community attention and negligible current threat to production environments, though prompt patching remains advisable for systems running vulnerable versions.