749 matches found
TOTPAuthenticate
TOTP Authenticate Uses session handling rules to add a TOTP token to outgoing requests. For Burp Suite Enterprise Edition Please note that extensions are written by third party users of Burp, and PortSwigger makes no warranty about their quality or usefulness for any particular purpose. Usage 1...
EUVD-2026-78653
Vikunja: TOTP secret is readable after enrollment, no step-up auth...
Vikunja: TOTP secret is readable after enrollment, no step-up auth
Summary Once a user has TOTP enabled, the API still hands back the raw shared secret to anyone holding that account's access token. Reading it doesn't ask for the password, even though disabling TOTP does. So a stolen token, an XSS, or a browser left open is enough to copy the second factor into...
GHSA-88F6-4RJV-X774 Vikunja: TOTP secret is readable after enrollment, no step-up auth
Summary Once a user has TOTP enabled, the API still hands back the raw shared secret to anyone holding that account's access token. Reading it doesn't ask for the password, even though disabling TOTP does. So a stolen token, an XSS, or a browser left open is enough to copy the second factor into...
CVE-2026-103977
Summary FileRise versions before 3.23.0 stored failed TOTP verification attempts in PHP session state. The counter limited attempts within one session but did not persist across newly created sessions. An attacker who already possesses a target account's valid primary credential could restart the...
CVE-2026-107638 pH7Builder before 18.5.0 2FA Brute Force via VerificationCodeFormProcess.php
pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit verificatio...
CVE-2026-107638 pH7Builder before 18.5.0 2FA Brute Force via VerificationCodeFormProcess.php
pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit verificatio...
hotpot
Hotpot 🍲 Authy / Google Authenticator for the command line. Hotpot is a simple and secure command-line tool for managing TOTP-based two-factor authentication codes. Hotpot securely stores your 2FA secrets in your system's keyring and generates time-based one-time passwords when you need them. Bui...
joomla-bruteforce
joomla-bruteforce Joomla login bruteforce Tested on Joomla! 3.8.8 Usage: python3 joomla-brute.py -u http://10.10.10.150 -w /usr/share/wordlist/rockyou.txt -usr admin chmod +x joomla-brute.py ./joomla-brute.py -u http://10.10.10.150 -w /usr/share/wordlist/rockyou.txt -usr admin Optional parameters...
DRUPAL-CONTRIB-2026-197
This module provides TOTP-based two-factor authentication 2FA for Drupal. The module doesn't enforce the second factor when a user logs in with Drupal core's one-time login link. This vulnerability is mitigated by the fact that an attacker must have access to a valid one-time login link for a...
CVE-2026-107180
On MISP instances where Security.otp_required is enabled, a logic flaw allows authenticated users to bypass mandatory TOTP enrolment . The enforcement mechanism only applied to standard browser requests; consequently, users could bypass the setup by issuing non-browser requests such as AJAX/XHR c...
EUVD-2026-94318
On MISP instances configured to require TOTP enrolment Security.otprequired, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...
CVE-2026-107180 MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances
On MISP instances configured to require TOTP enrolment Security.otprequired, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...
CVE-2026-107180 MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances
On MISP instances configured to require TOTP enrolment Security.otprequired, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...
CVE-2026-107180 MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances
On MISP instances configured to require TOTP enrolment Security.otprequired, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...
PT-2026-107747
This module provides TOTP-based two-factor authentication 2FA for Drupal. The module doesn't enforce the second factor when a user logs in with Drupal core's one-time login link. This vulnerability is mitigated by the fact that an attacker must have access to a valid one-time login link for a...
PT-2026-107752
This module provides TOTP-based two-factor authentication 2FA for Drupal, with an optional setting to enforce 2FA for all users site-wide. The module may allow a user log in with only a password even when site-wide enforcement of 2FA is turned on...
CVE-2026-107180: Improper Authentication
On MISP instances configured to require TOTP enrolment Security.otprequired, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...
PT-2026-107499
On MISP instances configured to require TOTP enrolment Security.otp required, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...
CVE-2026-105835
PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one...