[security:low] If SFA is enabled with impersonation plugin, users can add or remove spoofed user s 2f devices
Environment
LemonLDAP::NG version: 2.0.3 and other
Operating system: all
Web server: all
Summary
Enable sfa and impersonation. Log in as dwho and spoof rtyler. You can append or remove sfa from rtyler persistent session.
Possible fixes
Detect that impersonation is in progress and forbid delete or add action.