View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0011483 | Taler | merchant portal webui | public | 2026-06-06 01:55 | 2026-09-04 19:27 |
| Reporter | vecirex | Assigned To | Christian Grothoff | Resolution deadline | |
| Implementer | Reviewer | ||||
| Release signed by | Deployed by | ||||
| Verifier | Communicator | ||||
| Data protection authority notification required | No | ||||
| CSIRT notification required | No | ||||
| Estimated effort (hours) | Actual effort (hours) | 0 | |||
| Fast-track | No | ||||
| Work package | none | ||||
| Priority | normal | Severity | major | Reproducibility | always |
| Status | closed | Resolution | fixed | ||
| Target Version | 1.6 | Fixed in Version | 1.6 | ||
| Summary | 0011483: Adding another IBAN requires MFA, but can be circumvented | ||||
| Description | Adding ticket via and confirmed by fd during yesterday's QC session: Being logged in, adding an additional IBAN acc. requires one additional factor (sms or email, given taler-merchant has tan methods activated by config; like for mytops). This makes sense because an actor (like employee or just any attacker with access to the the open screen) could try to redirect money to his very own account, by just adding another IBAN. By a tan method being required, most attackers would be prevented from doing so. However, it's possible to just delete the first IBAN added and replace it by the "second" one, or: the security model is broken, because in this case no tan method is required. | ||||
| Additional Information | With Instant SEPA coming also to CH, downtime because of KYC Auth pending to the new attacker's IBAN would be neglectable. | ||||
| Tags | No tags attached. | ||||
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2026-06-06 01:55 | vecirex | New Issue | |
| 2026-06-06 01:58 | vecirex | Description Updated | |
| 2026-06-06 01:58 | vecirex | Additional Information Updated | |
| 2026-06-06 01:59 | vecirex | Summary | Adding additional IBAN requires MFA, but can be circumvented => Adding another IBAN requires MFA, but can be circumvented |
| 2026-06-06 02:08 | vecirex | Relationship added | related to 0011484 |
| 2026-06-06 16:25 | Christian Grothoff | Assigned To | => Christian Grothoff |
| 2026-06-06 16:25 | Christian Grothoff | Status | new => implementing |
| 2026-06-06 16:25 | Christian Grothoff | Target Version | => 1.7 |
| 2026-06-06 22:07 | Christian Grothoff | Status | implementing => assigned |
| 2026-06-07 21:07 | Christian Grothoff | Status | assigned => informing |
| 2026-06-07 21:07 | Christian Grothoff | Resolution | open => fixed |
| 2026-06-07 21:07 | Christian Grothoff | Fixed in Version | => 1.6 |
| 2026-06-07 21:07 | Christian Grothoff | Note Added: 0028802 | |
| 2026-06-07 21:07 | Christian Grothoff | Target Version | 1.7 => 1.6 |
| 2026-08-23 14:18 | Florian Dold | Category | merchant backoffice SPA => merchant portal webui |
| 2026-09-04 19:27 | vecirex | Note Added: 0029876 | |
| 2026-09-04 19:27 | vecirex | Status | informing => closed |