External risk intelligence

SQL Injection in Two-Factor Authentication Allows Unauthenticated Database Access.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-10731

The vulnerability resides in a user-login endpoint specifically designed for two-factor authentication. As a pre-authentication component of a web application's login process, this interface is intentionally exposed to the public internet to facilitate user access.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical SQL injection vulnerability affecting the two-factor authentication process. Unauthenticated attackers can exploit this flaw to execute arbitrary SQL commands, potentially leading to unauthorized access, data manipulation, or service disruption. The primary concern is to verify if this specific authentication functionality is in use within your environment.

Unauthenticated attackers can inject malicious SQL queries.
Matters for protecting user login and data integrity.
Confirm if this two-factor authentication is used.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to the `/user-login` endpoint. This request targets the `two_steps_auth_code` parameter within the `twoStepsAuthVerification` function, which handles two-factor authentication. Because this function can be accessed without logging in, an unauthenticated attacker can inject malicious SQL code. This could lead to severe consequences, including unauthorized access to sensitive data, creation of new administrator accounts, or disruption of services.

No authentication required.
Triggered by manipulating a parameter.
Allows arbitrary SQL queries.

Live Threat

Current exploitation, exposure, and threat context

This SQL injection vulnerability in the two-factor authentication code could allow unauthenticated attackers to execute arbitrary SQL queries. When supported by the advisory, this could lead to database information disclosure, the creation of unauthorized privileged users, modification or deletion of critical data, and denial-of-service conditions.

Database integrity and availability.
Unauthenticated SQL query execution.
Unauthorized user creation or data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in the two-factor authentication code parameter impacts backend databases, potentially leading to unauthorized data access, user privilege escalation, or denial-of-service. Owners of the application housing this login endpoint, likely a platform or application team, should first identify all instances of the affected technology, confirm their internet exposure and business criticality, and then coordinate with security and vendor management teams to plan remediation.

Identify system owners and confirm exposure.
Verify internet reachability and business impact.
Plan vendor coordination and remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the software component affected by CVE-2026-10731?

This CVE impacts the two-factor authentication (2FA) functionality within web applications. Specifically, it involves a verification function that processes 2FA codes during the login flow. This component is essential for validating user identity before granting access to the system, acting as a security gatekeeper for the platform.

How does this SQL injection vulnerability work?

The flaw is categorized as CWE-89, which occurs when software improperly neutralizes special elements used in an SQL command. In this case, the `two_steps_auth_code` parameter is not properly sanitized before being processed by the database. An attacker can use this weakness to inject their own database instructions, effectively tricking the application into running unauthorized queries instead of just verifying a 2FA code.

What triggers this vulnerability in the login process?

The vulnerability is triggered by sending a maliciously crafted request to the `/user-login` endpoint. Because the affected function is designed to handle 2FA verification, it is accessible before a user successfully logs in. Simply navigating to the site or using legitimate login credentials does not trigger the bug; the attacker must intentionally send specifically formatted input to the targeted parameter to execute the injection.

Why should I care about this if my system is internal?

Halo Surface Signal identifies this vulnerability as highly relevant because the targeted login endpoint is typically exposed to the public internet to allow users to authenticate. While internal systems may have a smaller attack surface, any instance where this 2FA interface is reachable from outside your network increases the risk of unauthorized database access or service disruption.

What should I do if I use this technology?

Your first step is to identify all instances of the application that utilize this specific 2FA functionality. Once identified, assess whether the login endpoint is accessible to the public and determine the business criticality of those assets. Coordinate with your internal security and vendor management teams to track available updates or guidance from your software provider to mitigate this risk.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.