Security Resilience

CVE-2025-45731

Race Condition in 2Fauth 5.4.3

Public PoCRace Condition
Published
24 July 2025
Modified
17 June 2026
Patch / advisory
View advisory
CVSS Score v3.1 6.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
EPSS Score 0.0032 23th percentile
Risk Priority 50 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2025-45731 is a medium-severity Race Condition (CWE-362) vulnerability in 2Fauth 2Fauth. Its CVSS base score is 6.5 (Medium).

Operationally, ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SC-39 (Process Isolation) and SC-4 (Information in Shared System Resources) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability Data

A group deletion race condition in 2FAuth v5.5.0 causes data inconsistencies and orphaned accounts when a group is deleted while other operations are pending.

CWE(s)
CWE-362

Related Threats

CVEs Like This One

CVE-2024-52598Same product: 2Fauth 2Fauth
CVE-2023-36816Same product: 2Fauth 2Fauth
CVE-2024-52597Same product: 2Fauth 2Fauth
CVE-2026-32133Same product: 2Fauth 2Fauth
CVE-2024-57893Shared CWE-362
CVE-2025-46284Shared CWE-362
CVE-2026-49803Shared CWE-362
CVE-2026-2802Shared CWE-362
CVE-2026-23097Shared CWE-362
CVE-2024-40953Shared CWE-362

Affected Assets

2fauth
2fauth
5.4.3

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SC-39 Process Isolation partial match

Maintaining separate execution domains for each process structurally eliminates unintended concurrent access to the same shared resources.

SC-4 Information in Shared System Resources partial match

Preventing unintended information transfer through shared system resources directly addresses the improper concurrent modification that defines a race condition.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect race conditions, but does not prevent them at design or coding time.

A.8.28 Secure coding partial match
prevents

Secure coding standards explicitly forbid unsafe concurrent access patterns and mandate atomic operations or locks.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-362, a class-level weakness, and none of its children carries one either.

References