Attack Chain

1. An unauthenticated attacker identifies a target FacturaScripts instance accessible via the network.
2. The attacker determines a valid username (fsNick) belonging to a 2FA-enabled account (e.g., 'admin', 'company_name', or user initials).
3. The attacker sends numerous HTTP POST requests to the /login endpoint, specifically targeting the action=two-factor-validation parameter.
4. Each POST request includes the target fsNick and an iterated 6-digit fsTwoFactorCode value.
5. The twoFactorValidationAction() endpoint processes these requests without requiring prior password authentication, validating a CSRF token, or applying rate-limiting, allowing for rapid brute-force attempts.
6. Due to the configured TwoFactorManager::VERIFICATION_WINDOW = 8, up to 17 TOTP codes are simultaneously valid for a single 30-second time slot, greatly facilitating the brute-force process.
7. Upon a successful guess of a valid fsTwoFactorCode, the server issues a complete session cookie pair (fsNick and fsLogkey) without further security checks.
8. The attacker uses the obtained session cookies to gain full and persistent access to the victim's account, allowing them to read sensitive data, modify records, change permissions, and potentially install malicious plugins.

Impact

Successful exploitation of CVE-2026-47677 leads to complete account takeover for any 2FA-enabled user within FacturaScripts, including administrative accounts. This results in high confidentiality impact, allowing attackers to access all data visible to the compromised user, such as invoices, customer information, accounting ledgers, attached files, and API keys. The integrity impact is also high, as attackers can create, modify, or delete records, alter user permissions, and potentially upload or install malicious code through admin privileges. Furthermore, the vulnerability enables a targeted denial of service (DoS) by allowing attackers to generate six failed 2FA attempts for a specific user, triggering an account lockout for 10 minutes (MAX_INCIDENT_COUNT = 6). This lockout mechanism can be repeatedly exploited, effectively blocking legitimate users from accessing their accounts.

Recommendation

• Deploy a patch that implements the four fixes outlined in the advisory for CVE-2026-47677, specifically requiring password completion evidence (nonce), CSRF token validation, pre-check of user incidents, and reducing TwoFactorManager::VERIFICATION_WINDOW to 1.
• Implement the suggested Sigma rule to detect attempts to access the vulnerable /login?action=two-factor-validation endpoint.
• Enhance web server or WAF configurations to implement aggressive rate-limiting for POST requests to the /login endpoint, particularly those containing action=two-factor-validation.
• Enable comprehensive web server access logging to monitor for repeated POST requests to /login?action=two-factor-validation from single source IP addresses.