CVE-2026-110097: Improper Authentication in ikaros-dev ikaros

CVE-2026-110097 describes an authentication bypass vulnerability in ikaros-dev's ikaros product versions 1.2.0 through 1.2.5. The flaw allows an attacker with a valid password to bypass the two-factor authentication (TOTP) by reusing a temporary login token from the jwt/apply endpoint. This token can be used as a bearer JWT, refreshed, or leveraged via HTTP Basic login to gain full account access, including master administrator rights. The vulnerability has a CVSS 4.0 score of 8.6, indicating high severity. No patch or remediation information is provided in the input data.

An attacker with a valid password can bypass the TOTP second-factor authentication, allowing full account compromise including master administrator access. This significantly increases the risk of unauthorized access and potential control over the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to accounts with valid passwords and monitor for suspicious use of temporary tokens. Avoid reuse of temporary login tokens and consider additional compensating controls to protect accounts requiring TOTP.