CVE-2026-107433

Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0...

CVE-2026-107433

The WP OAuth Server plugin by miniOrange (versions up to and including 6.4.0 ) is vulnerable to a Broken Access Control issue (CWE-862). The root cause is Missing Authorization , which allows for the exploitation of Incorrectly Configured Access Control Security Levels . This vulnerability has a ...

EUVD-2026-101008

Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0...

CVE-2026-106610

Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7...

EUVD-2026-96404

Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7...

CVE-2026-106610 WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7...

CVE-2026-106610

The miniOrange OTP Verification WordPress plugin (versions

CVE-2026-77771

CVE-2026-77771 — miniOrange 2FA Free & Pro: 2FA Bypass via Session-Scoped OTP Lockout An authentication bypass in the miniOrange Two-Factor Authentication plugin for WordPress allows an attacker who already holds a victim's valid password to brute-force the second factor without limit, defeating...

WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by KevineCharles in WordPress Plugin miniorange otp verification versions = 5.5.7...

CVE-2026-15013

CVE-2026-15013 — miniOrange SAML SSO = 5.4.3 Auth Bypass PoC Proof-of-concept for CVE-2026-15013 : unauthenticated authentication bypass via SAML Signature Algorithm Confusion HMAC-SHA1 in the miniOrange SAML Single Sign On – SSO Login WordPress plugin versions up to and including 5.4.3. Authoriz...

Exploit for CVE-2026-107268

CVE-2026-107268: miniOrange 2FA for Drupal returns the site's...

DRUPAL-CONTRIB-2026-207

This module enables you to add an extra layer of verification for user login flow. The Two Factor Authentication - TFA / Passwordless Login module for Drupal contains a vulnerability in the headless login endpoint that can disclose the site's stored miniOrange customer API key to unauthenticated...

Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

This module enables you to add an extra layer of verification for user login flow. The Two Factor Authentication - TFA / Passwordless Login module for Drupal contains a vulnerability in the headless login endpoint that can disclose the site's stored miniOrange customer API key to unauthenticated...

PT-2026-107759

This module enables you to add an extra layer of verification for user login flow. The Two Factor Authentication - TFA / Passwordless Login module for Drupal contains a vulnerability in the headless login endpoint that can disclose the site's stored miniOrange customer API key to unauthenticated...

CLEANSTART-2024-DI95704 Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability

Security vulnerability affects the drupal7 package. Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability...

WordPress miniOrange OTP Login, Verification and SMS Notifications plugin <= 5.5.5 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Supakiad S. m3ez in WordPress Plugin miniorange otp verification versions = 5.5.5...

Exploit for CVE-2026-85984

CVE-2026-85984 — miniOrange OTP Login Auth Bypass Python 3...

CVE-2026-77770

CVE-2026-77770 miniOrange 2FA CVE POC miniOrange 2FA（WordPress 插件 miniorange-2-factor-authentication）≤ 6.3.0 — 通过电子邮件验证链接（userID / Txid / accessToken）实现未认证的任意 WordPress 选项删除。 仅限授权测试。请勿对您不拥有或未获授权测试的系统运行此工具。 要求： Python 3，仅使用标准库。 python3 cve-2026-77770-miniorange-2fa-option-delete.py -u http://TARGE...

CVE-2026-85984

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mowploginintent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skippassfallback-enabled configuration bran...

EUVD-2026-87786

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mowploginintent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skippassfallback-enabled configuration bran...