Two-Factor Authentication Bypass in HashiCorp Terraform Enterprise

CVE-2021-3153

Summary

The vulnerability affects HashiCorp Terraform Enterprise versions up to v202102-2, where an organization-level setting meant to enforce two-factor authentication for users was not properly implemented. As a result, users operating within organizations could potentially access the system without enabling two-factor authentication, undermining the security measures intended to protect sensitive data. This flaw was addressed in version v202103-1, which enforced the two-factor authentication requirement correctly.

References