PT-2026-67974

Name of the Vulnerable Software and Affected Versions miniOrange 2FA WordPress plugin versions prior to 6.2.7 Description The plugin fails to bind the second factor configured during the pre-login two-factor challenge to the existing factor of the target account. This allows an attacker who...

CVE-2026-15372: Improper Authentication

The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator...

PT-2026-67973

Name of the Vulnerable Software and Affected Versions WP 2FA versions prior to 4.1.0 Description The plugin fails to validate the second authentication factor during the login process when a supported method is selected. This allows an attacker who possesses a user's password to bypass the...

PT-2026-67877

Name of the Vulnerable Software and Affected Versions Baserow versions prior to 2.3.3 Description An issue in the 2FA Verify Endpoint allows for improper authentication via remote manipulation. The flaw exists within the verify function located in the backend/src/baserow/api/two factor...

CVE-2026-16035: Missing Authorization

The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the...

CVE-2026-18816: Improper Authentication

A vulnerability was identified in Baserow up to 2.3.2. Affected by this vulnerability is the function verify of the file backend/src/baserow/api/twofactorauth/views.py of the component 2FA Verify Endpoint. Such manipulation leads to improper authentication. The attack may be launched remotely. Th...

CVE-2026-12695 miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret

The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor...

CVE-2026-12695: Improper Authentication

The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor...

CVE-2026-12703: Authentication Bypass Using an Alternate Path or Channel

TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that can allow an authenticated attacker to bypass a configured 2FA for Connections approval flow via Unattended Access and establish a remote connection to an affected macOS host...

CVE-2026-63238: Improper Authentication

An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid user UUID without providing primary credentials via the 2FA validation endpoint...

[20260807] - Core - MFA Authentication Bypass

Insufficient state checks lead to a vector that allows to bypass 2FA checks...

CVE-2026-42210: Improper Authentication

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor typically TOTP, an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication...

CVE-2026-62236: Cross-Site Request Forgery (CSRF)

grav-plugin-login before 3.8.11 contains a cross-site request forgery CSRF vulnerability in the login.regenerate2FASecret frontend task, which regenerates and persists a new TOTP secret for the authenticated session user without any anti-CSRF nonce or Origin/Referer check. Because Grav core...

CVE-2026-12988: Missing Authorization

The WP 2FA WordPress plugin before 3.1.1.2 does not verify that the email address supplied during two-factor authentication setup belongs to the user, allowing an attacker who has obtained a user's credentials to redirect the setup verification code to an attacker-controlled email address and tak...

CVE-2026-55207: Weak Password Recovery Mechanism for Forgotten Password

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, an unauthenticated attacker who knows a valid admin username can take over any Pimcore admin account by sending a password reset request with an attacker-controlled resetPasswordUrl. The server...

django-restframework-2fa (>=0.0.15, <=0.0.16), los-docusign (0.2.2) +2 more potentially affected by CVE-2024-22513 via djangorestframework-simplejwt (4.6.0)

djangorestframework-simplejwt PYPI version 4.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on djangorestframework-simplejwt and may be impacted: - django-restframework-2fa =0.0.15, =0.0.16 - los-docusign 0.2.2 - tea-django 0.0.14 - traktor 0.0.10...

CVE-2026-54040

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/auth/2fa/backup/regenerate endpoint regenerates all 2FA backup codes without requiring any TOTP token or existing backup code verification. An attacker with a stolen session token can...

CVE-2026-54036: Missing Authentication for Critical Function

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the GET /api/auth/2fa/enable endpoint can be called by an authenticated user or attacker with a stolen session even when 2FA is already fully enabled on the account. This endpoint overwrites the existi...

CVE-2026-54040: Missing Authentication for Critical Function

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/auth/2fa/backup/regenerate endpoint regenerates all 2FA backup codes without requiring any TOTP token or existing backup code verification. An attacker with a stolen session token can...

CVE-2026-56338: Improper Check or Handling of Exceptional Conditions

Capgo before 12.128.2 contains a denial of service vulnerability in the /auth/v1/otp endpoint that prevents email verification for two-factor authentication due to captcha validation failures. Authenticated users cannot complete 2FA enrollment as the backend consistently returns HTTP 500 errors...