CVE-2026-119215

The team-alembic ash_authentication library is vulnerable to an Authorization Bypass Through User-Controlled Key (CWE-639) in versions 5.0.0-rc.0 before 5.0.0-rc.16 . The root cause is that AshAuthentication.Strategy.Totp.ConfirmSetupChange fails to verify that a setup token was issued to the spe...

CVE-2026-119215 AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account

Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ashauthentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor...

POC-CVE-2026-18963

CVE-2026-18963 — Keycloak Forgot-Password Flow Authentication Bypass PoC Proof of Concept for CVE-2026-18963 , a flaw in Keycloak's "Forgot Password" / credential-selection flow that allows an attacker to reach the UPDATEPASSWORD step — and reset a target account's password — without properly...

CVE-2026-115829

In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only...

CVE-2026-115829

Secret Server versions earlier than 12.3.1 are vulnerable to an authentication bypass where a user can skip the initial login step. By successfully negotiating only the second factor login step , an attacker can gain unauthorized access. This flaw is categorized under CWE-288 (Authentication Bypa...

CVE-2026-115829 Secret Server partial login bypass

In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only...

CVE-2026-115829 Secret Server partial login bypass

In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only...

EUVD-2026-114374

In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only...

CVE-2026-115829: Delinea Secret Server: In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by…

In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only...

PT-2026-134148

In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only...

Linux Distros Unpatched Vulnerability : CVE-2026-107145

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The twofactorgauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who...

CVE-2026-107145

The twofactorgauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system. This...

CVE-2026-107145

The twofactorgauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system. This...

UBUNTU-CVE-2026-107145

The twofactorgauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system. This...

CVE-2026-107145

The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code due to a lack of rate-limiting in the 2FA code check mechanism (CWE-307). An attacker who obtains a user's password can submit arbitrary 6-digit codes to bypass the second factor and gain un...

EUVD-2026-110647

The twofactorgauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system. This...

CVE-2026-107145

The twofactorgauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system. This...

CVE-2026-107145 Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator

The twofactorgauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system. This...

CVE-2026-117470 WebAuthn assertion replay permits second-factor bypass in Psono Server

Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user's password and one captured valid WebAuthn assertion could replay that assertion with separate login tokens while t...

CVE-2026-117470

Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user's password and one captured valid WebAuthn assertion could replay that assertion with separate login tokens while t...