CVE-2020-37094

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-37094
EspoCRM 5.7.0 prior to 5.9.0 contains an authentication token reuse vulnerability that allows authenticated attackers to bypass two-factor authentication by exploiting token-to-password-hash mapping in application/Espo/Core/Utils/Authentication/Espo.php. Attackers can obtain an authentication token for a controlled account and replay it against any victim account sharing the same password, since tokens are bound to password hashes rather than unique per-user values, bypassing the victim's 2FA protections.

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/espocrm/espocrm/commit/b299220dd0c7acdaa1ed8be8ffd79c7985093c7a
https://www.espocrm.com Product
https://www.exploit-db.com/exploits/48376 Exploit VDB Entry
https://www.vulncheck.com/advisories/espocrm-two-factor-auth-bypass-via-auth-token-reuse-between-accounts-with-identical-passwords
Configurations

Configuration 1 (hide)

cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*
History

10 Jul 2026, 15:16

Type Values Removed Values Added
CWE CWE-639 CWE-303
CVSS v2 : unknown
v3 : 9.8 		v2 : unknown
v3 : 8.1
References
  • {'url': 'https://www.vulncheck.com/advisories/espocrm-privilege-escalation', 'tags': ['Third Party Advisory'], 'source': 'disclosure@vulncheck.com'}
  • () https://github.com/espocrm/espocrm/commit/b299220dd0c7acdaa1ed8be8ffd79c7985093c7a -
  • () https://www.vulncheck.com/advisories/espocrm-two-factor-auth-bypass-via-auth-token-reuse-between-accounts-with-identical-passwords -
Summary (en) EspoCRM 5.8.5 contains an authentication vulnerability that allows attackers to access other user accounts by manipulating authorization headers. Attackers can decode and modify Basic Authorization and Espo-Authorization tokens to gain unauthorized access to administrative user information and privileges. (en) EspoCRM 5.7.0 prior to 5.9.0 contains an authentication token reuse vulnerability that allows authenticated attackers to bypass two-factor authentication by exploiting token-to-password-hash mapping in application/Espo/Core/Utils/Authentication/Espo.php. Attackers can obtain an authentication token for a controlled account and replay it against any victim account sharing the same password, since tokens are bound to password hashes rather than unique per-user values, bypassing the victim's 2FA protections.

03 Mar 2026, 14:59

Type Values Removed Values Added
References () https://www.espocrm.com - () https://www.espocrm.com - Product
References () https://www.exploit-db.com/exploits/48376 - () https://www.exploit-db.com/exploits/48376 - Exploit, VDB Entry
References () https://www.vulncheck.com/advisories/espocrm-privilege-escalation - () https://www.vulncheck.com/advisories/espocrm-privilege-escalation - Third Party Advisory
Summary
  • (es) EspoCRM 5.8.5 contiene una vulnerabilidad de autenticación que permite a los atacantes acceder a otras cuentas de usuario manipulando los encabezados de autorización. Los atacantes pueden decodificar y modificar los tokens Basic Authorization y Espo-Authorization para obtener acceso no autorizado a información y privilegios de usuarios administrativos.
First Time Espocrm espocrm
Espocrm
CPE cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*

03 Feb 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-03 22:16

Updated : 2026-07-15 02:17

NVD link : CVE-2020-37094

Mitre link : CVE-2020-37094

CVE.ORG link : CVE-2020-37094

JSON object : View

Products Affected

espocrm

  • espocrm
CWE
CWE-303

Incorrect Implementation of Authentication Algorithm