Ikaros: Authentication bypass of TOTP two-factor verification via temp token
Summary
Ikaros 1.2.0 through 1.2.5 allows an attacker who already knows a valid password to skip TOTP two-factor verification by reusing the login temporary token. The temp token can be presented as a bearer JWT, refreshed, or used through HTTP Basic login. This leads to full account access, including the master administrator account.
Affected
- Ikaros 1.2.0 through 1.2.5
- Ikaros versions before 1.2.0 are not listed as affected
Fixed in
Unknown. No fixed version has been confirmed by the vendor at the time of writing.
Workaround
Unknown. No vendor workaround has been published.
- Do not expose the Ikaros web interface or API to the internet; restrict access to the LAN or a VPN
- Use a strong, unique password for all Ikaros accounts, especially the administrator account
Exploitation
- CISA SSVC: exploitation status 'poc' (proof of concept exists), not automatable
- No evidence of active exploitation in the wild found
- Detailed write-ups describing the mechanism are published; their exploit content is unverified
Our recommendation
- Check whether Ikaros is in use and whether it is reachable from the internet
- If it is exposed, restrict access to the LAN or a VPN now
- Review administrator accounts and sessions for unexpected logins or changes
- Change passwords and enable monitoring of login events
- Plan an upgrade as soon as a fixed version is confirmed by the vendor
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Ikaros v1.2.5 release github.com
- SecurityEndpoint.java at v1.2.5 github.com
- JwtAuthenticationFilter.java at v1.2.5 github.com
- OSV entry CVE-2026-110097 osv.dev
- VulDB entry 417828 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:27.
Original description (NVD)
Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp token. Attackers can present the temp token from the jwt/apply endpoint as a bearer JWT, refresh it, or use HTTP Basic login to gain full account access, including the master administrator.
NVD references (7)
- https://github.com/ikaros-dev/ikaros/blob/v1.2.5/server/src/main/java/run/ikaros/server/security/SecurityEndp…
- https://github.com/ikaros-dev/ikaros/blob/v1.2.5/server/src/main/java/run/ikaros/server/security/authenticati…
- https://github.com/ikaros-dev/ikaros/blob/v1.2.5/server/src/main/java/run/ikaros/server/security/authenticati…
- https://github.com/ikaros-dev/ikaros/releases/tag/v1.2.5
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ikaros-2fa-bypass-temp-token
- https://www.vulncheck.com/advisories/ikaros-1.2.0-through-1.2.5-totp-authentication-bypass-via-temp-token
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/cve-2026-110097-ikaros-2fa-bypass-temp-token
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.