CVE-2026-110097Published
Ikaros 1.2.0 through 1.2.5 TOTP Authentication Bypass via Temp Token
Exact source revision recorded 23 Oct 2026 15:48:27 UTC. It does not establish the source's current position. Latest evidence.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-110097 · Microsoft / collected KEV context
cve-program · CVE-2026-110097
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ikaros-2fa-bypass-temp-token
- https://github.com/ikaros-dev/ikaros/blob/v1.2.5/server/src/main/java/run/ikaros/server/security/authentication/jwt/JwtAuthenticationProvider.java#L57-L112
- https://github.com/ikaros-dev/ikaros/blob/v1.2.5/server/src/main/java/run/ikaros/server/security/authentication/jwt/JwtAuthenticationFilter.java#L30-L46
- https://github.com/ikaros-dev/ikaros/blob/v1.2.5/server/src/main/java/run/ikaros/server/security/SecurityEndpoint.java#L80-L118
- https://github.com/ikaros-dev/ikaros/releases/tag/v1.2.5
- https://www.vulncheck.com/advisories/ikaros-1.2.0-through-1.2.5-totp-authentication-bypass-via-temp-token
Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.