Improper Authentication

com.liferay, com.liferay.multi.factor.authentication.timebased.otp.web is vulnerable to improper authentication. The vulnerability is due to the reuse of time-based one-time passwords TOTP within their validity period, which allows an attacker with access to a user’s TOTP to authenticate as that...

Nagios Fusion 安全漏洞

Nagios Fusion is a centralized monitoring and visualization platform from Nagios Corporation, USA. A security vulnerability exists in Nagios Fusion version v2024R1.2 and v2024R2, which stems from a lack of rate limiting in the OTP authentication component, which could lead to a brute force attack...

privacyIDEA Authenticator 安全漏洞

privacyIDEA Authenticator is a login authentication application from the privacyIDEA organization. A security vulnerability exists in privacyIDEA Authenticator version 4.3.0 that stems from improper handling of OTP/TOTP/HOTP values, which could allow a local attacker to bypass dual authentication...

EUVD-2025-36185

Improper handling of OTP/TOTP/HOTP values in NetKnights GmbH privacyIDEA Authenticator v.4.3.0 on Android allows local attackers with root access to bypass two factor authentication. By hooking into app crypto routines and intercepting decryption paths, attacker can recover plaintext secrets,...

CVE-2025-60424

A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication via a bruteforce attack...

CVE-2025-61482

Improper handling of OTP/TOTP/HOTP values in NetKnights GmbH privacyIDEA Authenticator v.4.3.0 on Android allows local attackers with root access to bypass two factor authentication. By hooking into app crypto routines and intercepting decryption paths, attacker can recover plaintext secrets,...

CVE-2025-61482

The CVE-2025-61482 vulnerability affects privacyIDEA Authenticator for Android (version 4.3.0). A local attacker with root access can bypass two-factor authentication by hooking cryptographic routines and intercepting decryption paths to recover plaintext secrets, enabling generation of valid OTP...

CVE-2025-60424

CVE-2025-60424 affects Nagios Fusion versions 2024R1.2 and 2024R2. The root cause is a lack of rate limiting in the OTP verification component, which allows authentication bypass via brute-force attempts. Affected product: Nagios Fusion; the issue is documented across multiple sources (Red Hat CG...

WordPress Orion SMS OTP Verification plugin elevation of privilege vulnerability

WordPress Orion SMS OTP Verification plugin is an authentication plugin for WordPress that enables user verification by sending a one-time password OTP via text message SMS. An elevation of privilege vulnerability exists in the WordPress Orion SMS OTP Verification plugin, which can be exploited b...

EUVD-2025-35049

A lack of rate limiting in the One-Time Password OTP verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification via a bruteforce attack...

CVE-2025-56224

A lack of rate limiting in the One-Time Password OTP verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification via a bruteforce attack...

CVE-2025-56224

CVE-2025-56224 concerns SigningHub v8.6.8, where a lack of rate limiting on the One-Time Password (OTP) verification endpoint enables brute-force bypass of verification. The Red Hat, NVD, ENISA EUVD, CIRCL, CNNVD and other feeds corroborate that the vulnerability allows bypassing OTP verification...

CVE-2025-56224

A lack of rate limiting in the One-Time Password OTP verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification via a bruteforce attack...

SigningHub 安全漏洞

SigningHub is an electronic signature platform from SigningHub UK. A security vulnerability exists in SigningHub version v8.6.8, which stems from a lack of rate limiting in the one-time password verification endpoint, which could lead to a brute force attack to bypass the verification...

CVE-2025-56224

A lack of rate limiting in the One-Time Password OTP verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification via a bruteforce attack...

CVE-2025-9967

The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.7. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for...

CVE-2025-9967 Orion SMS OTP Verification <= 1.1.7 - Authentication Bypass via Account Takeover

The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.7. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for...

CVE-2025-9967 Orion SMS OTP Verification <= 1.1.7 - Authentication Bypass via Account Takeover

The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.7. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for...

WordPress plugin Orion SMS OTP Verification 安全漏洞

WordPress Orion SMS OTP Verification plugin is an authentication plugin for WordPress that enables user verification by sending a one-time password OTP via text message SMS. An elevation of privilege vulnerability exists in the WordPress Orion SMS OTP Verification plugin, which can be exploited b...

PT-2025-42226

CVE-2025-56224 CVE-2025-56224 OTP verification Bypass Description an attacker can impersonate another user mobile number and use this vulnerability to verify the number without knowing the OTP code. CVSS Score https://t.co/9m2AguFoY6...