Vulnerability · Published Feb 3, 2026 · Assigned by VulnCheck
CVE-2020-37094EspoCRM 5.7.0 < 5.9.0 - Two-Factor Authentication Bypass via Auth Token Reuse Between Accounts with Identical Passwords
High 8.1
In plain English
A high-severity security flaw in EspoCRM from EspoCRM. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Official description
EspoCRM 5.7.0 prior to 5.9.0 contains an authentication token reuse vulnerability that allows authenticated attackers to bypass two-factor authentication by exploiting token-to-password-hash mapping in application/Espo/Core/Utils/Authentication/Espo.php. Attackers can obtain an authentication token for a controlled account and replay it against any victim account sharing the same password, since tokens are bound to password hashes rather than unique per-user values, bypassing the victim's 2FA protections.
Affected products (as reported)
Weakness: CWE-303 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- ExploitDB-48376 exploit
- EspoCRM Official Vendor Homepage product
- Patch Commit patch
- VulnCheck Advisory third-party-advisory