11 matches found
CVE-2026-100709
Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens panel2fatokens without recording the account namespace, and the remembered-token lookup during login is not constrained to the customer or administrator account type. Because customer and administrator IDs are allocated...
PT-2026-81264
Name of the Vulnerable Software and Affected Versions liketrek TREK versions prior to 3.1.0 Description Remote manipulation of the loginUser function within the server/src/services/authService.ts file of the Pre-2FA mfa token Handler component leads to improper authentication. Recommendations...
CVE-2026-76207
phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with valid credentials can obtain a remember-me cookie, skip the 2FA challenge, and replay the cookie to gain full authenticated access...
CVE-2024-27928: Use of Single-factor Authentication
vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, if an attacker hacks into a vantage6 user's email account, they can 1 reset the password via email and then 2 reset the 2FA token via email. This way they reduce 2FA to 1FA email access. Note that...
CVE-2024-41978: Insertion of Sensitive Information into Log File
A vulnerability has been identified in RUGGEDCOM RM1224 LTE4G EU 6GK6108-4AM00-2BA2 All versions V8.1, RUGGEDCOM RM1224 LTE4G NAM 6GK6108-4AM00-2DA2 All versions V8.1, SCALANCE M804PB 6GK5804-0AP00-2AA2 All versions V8.1, SCALANCE M812-1 ADSL-Router family All versions V8.1, SCALANCE M816-1...
Timing attack
Affecting versions did not compare tokens in constant time, which could make it possible for an attacker to guess the 2fa token of a user. This has been fixed by using using the crate constanttimeeq for comparison...
CVE-2021-43067: Exposure of Sensitive Information to an Unauthorized Actor
A exposure of sensitive information to an unauthorized actor in Fortinet FortiAuthenticator version 6.4.0, version 6.3.2 and below, version 6.2.1 and below, version 6.1.2 and below, version 6.0.7 to 6.0.1 allows attacker to duplicate a target LDAP user 2 factors authentication token via crafted...
Information Disclosure
pimcore/pimcore is vulnerable to information disclosure. The vulnerability exists through brute-force attacks for the 2FA token...
Design/Logic Flaw
Pimcore before 6.2.2 lacks brute force protection for the 2FA token...
