CVE-2020-37094
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A vulnerability in EspoCRM 5.7.0 through 5.9.0 allows authenticated attackers to bypass two-factor authentication by reusing authentication tokens bound to password hashes. This enables token replay against any victim account sharing the same password.
Risk Assessment
The organization faces unauthorized account access despite 2FA, as attackers can hijack sessions of users with identical passwords.
Recommendation
Upgrade EspoCRM to version 5.9.0 or later immediately. Enforce password changes for all users to prevent shared password reuse.
Other vulnerabilities in EspoCRM
See all- CVE-2014-7985High
Directory traversal vulnerability in EspoCRM before version 2.6.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter to install/index.php.
- CVE-2026-33741Medium
EspoCRM versions 9.3.3 and below allow authenticated users to upload SVG attachments through normal attachment-capable fields and later serve those SVG files as top-level inline documents, resulting in stored cross-user XSS. Although inline SVG script is blocked by CSP, same-origin external script is allowed, so an attacker can upload a malicious SVG together with a second attacker-controlled JavaScript attachment and trick another user into opening the SVG to execute JavaScript.
Original NVD description (English source)
EspoCRM 5.7.0 prior to 5.9.0 contains an authentication token reuse vulnerability that allows authenticated attackers to bypass two-factor authentication by exploiting token-to-password-hash mapping in application/Espo/Core/Utils/Authentication/Espo.php. Attackers can obtain an authentication token for a controlled account and replay it against any victim account sharing the same password, since tokens are bound to password hashes rather than unique per-user values, bypassing the victim's 2FA protections.