Multi-Factor Authentication Bypass Vulnerability in EC-CUBE by EC-CUBE CO.,LTD.
CVE-2026-30777

6.9MEDIUM

Key Information:

Vendor

Ec-cube Co.,ltd.

Status
Ec-cube 4.1 Series
Ec-cube 4.2 Series
Ec-cube 4.3 Series
Vendor
CVE Published:
5 March 2026

What is CVE-2026-30777?

EC-CUBE, developed by EC-CUBE CO.,LTD., contains a serious vulnerability that allows attackers with valid administrative credentials to bypass the multi-factor authentication (MFA) process. This flaw could enable unauthorized access to the administrative interface, thereby exposing sensitive data and functionalities. Immediate action is advised to mitigate potential security risks associated with this vulnerability.

Affected Version(s)

EC-CUBE 4.1 series prior to 4.1.2-p5

EC-CUBE 4.2 series prior to 4.2.3-p2

EC-CUBE 4.3 series prior to 4.3.1-p1

References

https://www.ec-cube.net/info/weakness/20260209/index.php
https://jvn.jp/en/jp/JVN63765888/

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

CVSS V3.0

Score:
4.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.