CVE-2026-85237

A vulnerability in MISP's email-based one-time password OTP authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. The emailotp endpoint did not apply brute-force protection when validating submitted OTP values. An attacker who had reached the OTP...

2FA-Bypass-using-a-Brute-Force-Attack-CVE-2025-60424

ブルートフォース攻撃による2FAバイパス 概要 Nagios Fusionアプリケーション（バージョン2024R1.2および2024R2）は、二要素認証（2FA）メカニズムに対するブルートフォース攻撃に対して脆弱です。具体的には、2FAの実装はレート制限やアカウントロックアウトのメカニズムを適切に適用しておらず、攻撃者がワンタイムパスワード（OTP）を繰り返し推測することで2FAをバイパスできる可能性があります。 以下の問題が確認されました: レート制限の欠如 : 2FAエンドポイントはOTP送信試行回数を制限しません。 ロックアウトポリシーの不備 :...

CVE-2026-56338 Capgo - Denial of Service in 2FA Email Verification via /auth/v1/otp Endpoint

Capgo before 12.128.2 contains a denial of service vulnerability in the /auth/v1/otp endpoint that prevents email verification for two-factor authentication due to captcha validation failures. Authenticated users cannot complete 2FA enrollment as the backend consistently returns HTTP 500 errors...

CVE-2026-56338

Capgo before 12.128.2 contains a denial of service vulnerability in the /auth/v1/otp endpoint that prevents email verification for two-factor authentication due to captcha validation failures. Authenticated users cannot complete 2FA enrollment as the backend consistently returns HTTP 500 errors...

EUVD-2026-38752

Capgo before 12.128.2 contains a denial of service vulnerability in the /auth/v1/otp endpoint that prevents email verification for two-factor authentication due to captcha validation failures. Authenticated users cannot complete 2FA enrollment as the backend consistently returns HTTP 500 errors...