CVE-2026-15013

CVE-2026-15013 — miniOrange SAML SSO = 5.4.3 Bypass de Autenticación PoC Prueba de concepto para CVE-2026-15013 : bypass de autenticación no autenticado mediante confusión de algoritmo de firma SAML HMAC-SHA1 en el plugin de WordPress SAML Single Sign On – SSO Login de miniOrange versiones hasta ...

Exploit for CVE-2026-107268

CVE-2026-107268: miniOrange 2FA for Drupal returns the site's...

DRUPAL-CONTRIB-2026-207

This module enables you to add an extra layer of verification for user login flow. The Two Factor Authentication - TFA / Passwordless Login module for Drupal contains a vulnerability in the headless login endpoint that can disclose the site's stored miniOrange customer API key to unauthenticated...

PT-2026-107759

This module enables you to add an extra layer of verification for user login flow. The Two Factor Authentication - TFA / Passwordless Login module for Drupal contains a vulnerability in the headless login endpoint that can disclose the site's stored miniOrange customer API key to unauthenticated...

Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

This module enables you to add an extra layer of verification for user login flow. The Two Factor Authentication - TFA / Passwordless Login module for Drupal contains a vulnerability in the headless login endpoint that can disclose the site's stored miniOrange customer API key to unauthenticated...

CVE-2026-77771

CVE-2026-77771 — miniOrange 2FA Free y Pro: Omisión de 2FA mediante bloqueo de OTP con alcance de sesión Una omisión de autenticación en el plugin miniOrange Two-Factor Authentication para WordPress permite a un atacante que ya posee la contraseña válida de una víctima forzar por fuerza bruta el...

CLEANSTART-2024-DI95704 Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability

Security vulnerability affects the drupal7 package. Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability...

WordPress miniOrange OTP Login, Verification and SMS Notifications plugin <= 5.5.5 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Supakiad S. m3ez in WordPress Plugin miniorange otp verification versions = 5.5.5...

Exploit for CVE-2026-85984

CVE-2026-85984 — miniOrange OTP Login Auth Bypass Python 3...

CVE-2026-77770

CVE-2026-77770 miniOrange 2FA CVE POC miniOrange 2FA（WordPress 插件 miniorange-2-factor-authentication）≤ 6.3.0 — 通过电子邮件验证链接（userID / Txid / accessToken）实现未认证的任意 WordPress 选项删除。 仅限授权测试。请勿对您不拥有或未获授权测试的系统运行此工具。 要求： Python 3，仅使用标准库。 python3 cve-2026-77770-miniorange-2fa-option-delete.py -u http://TARGE...

CVE-2026-85984

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mowploginintent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skippassfallback-enabled configuration bran...

CVE-2026-85984

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress (versions up to and including 5.5.5 ) is vulnerable to an Authentication Bypass . The root cause is a missing password-intent guard in the mo_by_pass_login() function when the skip_pass_fallback configuration is ena...

EUVD-2026-87786

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mowploginintent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skippassfallback-enabled configuration bran...

CVE-2026-85984 miniOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mowploginintent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skippassfallback-enabled configuration bran...

CVE-2026-85984 miniOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mowploginintent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skippassfallback-enabled configuration bran...

CVE-2026-85984: Improper Authentication

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mowploginintent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skippassfallback-enabled configuration bran...

PT-2026-99412

Name of the Vulnerable Software and Affected Versions miniOrange OTP Login, Verification and SMS Notifications versions prior to 5.5.6 Description An authentication bypass exists when the mo wp login intent parameter is used. The issue occurs within the mo by pass login function, specifically in...

WordPress miniOrange 2FA plugin < 6.2.7 - 2FA Bypass via Password-Only Second-Factor Rebinding vulnerability

2FA Bypass via Password-Only Second-Factor Rebinding vulnerability discovered by Artus KG in WordPress Plugin miniOrange's Google Authenticator versions 6.2.7...

CVE-2026-89027

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or...

CVE-2026-89027

miniOrange JWT Authentication for WP REST APIs plugin for WordPress (before 4.8.0 ) contains an authentication method downgrade vulnerability. An unauthenticated attacker can supply a specific GET parameter that bypasses capability checks and nonce verification, forcing the plugin to use Basic HT...