CVE-2026-107146

The twofactorgauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to...

EUVD-2026-110648

The twofactorgauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to...

CVE-2026-107145 Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator

The twofactorgauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system. This...

CVE-2023-7028

CVE-2023-7028 | Account-Take-Over Gitlab Disclamer This code is a proof of concept of the vulnerability, I'm not pushing anyone to use it on gitlab instances they don't own. This tool has been developed for research and educational purposes only and I will not be held responsible for any use you...

PT-2026-126308

The twofactor gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For headers, an attacker who obtains user's password can spoof a whitelisted IP address, resulting in the...

PT-2026-126307

The twofactor gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password t...

CVE-2022-28986

CVE-2022-28986 A Insecure direct object references IDOR vulnerability in "Simple 2FA Plugin for Moodle" by LMS Doctor Vulnerability Details Risk : Critical Vendor: LMS Doctor - Simple 2 Factor Authentication Plugin For Moodle Disclosed by: Flaviu Popescu Description: Insecure direct object...

CVE-2022-28601

CVE-2022-28601 A Two-Factor Authentication 2FA bypass vulnerability in "Simple 2FA Plugin for Moodle" by LMS Doctor Vulnerability Details Risk : Medium Vendor: LMS Doctor - Simple 2 Factor Authentication Plugin For Moodle Disclosed by: Flaviu Popescu Description: Two-Factor Authentication Bypass...

CVE-2026-110956 asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation

The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator...

CVE-2026-110956

The asVereinbase WordPress plugin, in versions prior to 1.1.8 , contains an authentication bypass vulnerability. The flaw occurs because the plugin fails to require a valid password or a genuine second factor, instead treating an empty stored value as a successful match. This allows an unauthenti...

CVE-2026-110956 asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation

The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator...

WordPress miniOrange 2FA plugin 6.2.9-6.3.0 - 2FA Bypass vulnerability

2FA Bypass vulnerability discovered by RIA Labs in WordPress Plugin miniOrange's Google Authenticator versions 6.2.9-6.3.0...

CVE-2026-111949

The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor...

EUVD-2026-107076

The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor...

CVE-2026-111949

The miniOrange 2FA WordPress plugin versions before 6.3.1 is vulnerable to a 2FA bypass due to improper handling of passkey registrations. The root cause is that the plugin fails to prevent a pending passkey login from registering an additional passkey on an account that already has one configure...

CVE-2026-111949 miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding

The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor...

CVE-2026-111949 miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding

The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor...

PT-2026-120471

The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor...

PT-2026-118026

Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor 2FA bypass in github.com/0xJacky/Nginx-UI...

CVE-2026-111886

phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig 2FA removal endpoint, allowing authenticated attackers to guess TOTP codes without limit. Attackers holding a hijacked session and CSRF token can repeatedly POST guesses to...