CVE-2021-21329: Ratcf

Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days.

RATCF is an open-source framework for hosting Cyber-Security Capture the Flag events. In affected versions of RATCF users with multi factor authentication enabled are able to log in without a valid token. This is fixed in commit cebb67b.

Affected products

• Ratcf Ratcf: before 2021-02-26 (fixed in 2021-02-26)

Published 2021-03-08. Last modified 2026-06-17.