CVE-2026-40582 is an authentication bypass vulnerability in ChurchCRM CRM versions before 7.2.0. The vulnerability exists because the /api/public/user/login endpoint returns the user's API key after validating only username and password, circumventing the normal authentication flow that enforces account lockout and two-factor authentication. This allows an attacker with knowledge of a user's password to obtain API access and interact with all protected API endpoints with that user's privileges, regardless of account lockout status or 2FA enforcement. The vulnerability is classified under CWE-288 (Authentication Bypass Using Alternate Path or Channel) and CWE-305 (Authentication Bypass by Primary Weakness). The issue was resolved in ChurchCRM version 7.2.0.

An attacker who knows a valid user's password can bypass account lockout and two-factor authentication protections to obtain the user's API key. This grants the attacker direct access to all API endpoints accessible by that user, potentially exposing sensitive data or allowing unauthorized actions within the ChurchCRM system. The vulnerability is rated critical with a CVSS 4.0 score of 9.1, indicating high impact on confidentiality and integrity with network attack vector and no user interaction required. There are no known exploits in the wild at this time.

Upgrade ChurchCRM to version 7.2.0 or later, where this vulnerability has been fixed. Until the upgrade is applied, be aware that accounts with locked status or two-factor authentication enabled can still be bypassed via the vulnerable API endpoint if an attacker knows the user's password. No other mitigations are specified in the vendor advisory or CVE data.