CVE-2025-63700

CVE-2025-63700 OAuth Authentication Bypass in Clerk-js 5.88.0 Affected Product Vendor : Clerk Inc. clerk.dev / clerk.com Product : Clerk-js @clerk/clerk-js Affected Version : 5.88.0 Impact : OAuth Authentication Bypass CWE-290 : Authentication Bypass by Spoofing Bug Author Hasnat Ibrahim Nishat -...

CVE-2026-106610

Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7...

CVE-2026-106610

The miniOrange OTP Verification WordPress plugin (versions

EUVD-2026-96404

Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7...

CVE-2026-106610 WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7...

WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by KevineCharles in WordPress Plugin miniorange otp verification versions = 5.5.7...

CVE-2026-85237 Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass

A vulnerability in MISP's email-based one-time password OTP authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. The emailotp endpoint did not apply brute-force protection when validating submitted OTP values. An attacker who had reached the OTP...

CVE-2026-85237 Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass

A vulnerability in MISP's email-based one-time password OTP authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. The emailotp endpoint did not apply brute-force protection when validating submitted OTP values. An attacker who had reached the OTP...

CVE-2026-85237

MISP 's email_otp() endpoint lacked brute-force protection when validating OTP values, allowing an attacker who had passed the primary credential check to submit unlimited OTP guesses while the same OTP remained valid. The risk was compounded because OTPs are bound to the user rather than a singl...

PT-2026-85081

A vulnerability in MISP's email-based one-time password OTP authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. The email otp endpoint did not apply brute-force protection when validating submitted OTP values. An attacker who had reached the OTP...

Email Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-124

This module enables you to add extra layer of verification for user registration. The module doesn't sufficiently validate user-supplied input resulting in an account takeover vulnerability...

Email Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting - SA-CONTRIB-2026-125

This module enables you to add an extra layer of verification for user registration. The module doesn't sufficiently filter user-supplied input before output, resulting in an unauthenticated reflected Cross-site Scripting XSS vulnerability...

CVE-2026-61967

Unauthenticated Privilege Escalation in miniorange otp verification = 5.5.1 versions...

CVE-2026-61967

CVE-2026-61967 concerns an unauthenticated privilege-escalation vulnerability in the WordPress plugin miniorange OTP Verification (versions

EUVD-2026-57972

Unauthenticated Privilege Escalation in miniorange otp verification = 5.5.1 versions...

CVE-2026-61967

Unauthenticated Privilege Escalation in miniorange otp verification = 5.5.1 versions...

CVE-2026-61967: Weak Password Recovery Mechanism for Forgotten Password

Unauthenticated Privilege Escalation in miniorange otp verification = 5.5.1 versions...

WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by VDsec in WordPress Plugin miniorange otp verification versions = 5.5.1...

PT-2026-68559

Name of the Vulnerable Software and Affected Versions OTP Login With Phone Number versions prior to 1.8.71 Description The OTP Verification plugin for WordPress allows unauthenticated attackers to perform a brute force attack to bypass the One-Time Password OTP verification process during login...

CVE-2026-15210

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeri...