CVE-2026-109313

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as...

EUVD-2026-97615

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as...

CVE-2026-109313: Improper Authentication

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as...

PT-2026-110730

Name of the Vulnerable Software and Affected Versions Grav Login plugin versions 2.7.0 through 3.9.8 Description An authentication bypass exists that allows attackers possessing a valid password to circumvent two-factor authentication. This is achieved through remember-me cookie restoration, wher...

evilginx2

Evilginx 3.0 Evilginx es un framework de ataque de intermediario man-in-the-middle utilizado para el phishing de credenciales de inicio de sesión junto con cookies de sesión, lo que permite eludir la protección de autenticación de dos factores. Esta herramienta es la sucesora de Evilginx, lanzada...

EUVD-2026-78653

Vikunja: TOTP secret is readable after enrollment, no step-up auth...

CVE-2026-107638

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit verificatio...

EUVD-2026-95025

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit verificatio...

CVE-2026-107638 pH7Builder before 18.5.0 2FA Brute Force via VerificationCodeFormProcess.php

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit verificatio...

CVE-2026-107638 pH7Builder before 18.5.0 2FA Brute Force via VerificationCodeFormProcess.php

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit verificatio...

CVE-2026-107638

The pH7Builder (pH7 Social Dating CMS) software versions before 18.5.0 is vulnerable to an improper restriction of authentication attempts (CWE-307). The flaw resides in VerificationCodeFormProcess.php , where the system fails to limit attempts when verifying TOTP codes. An attacker who already p...

CVE-2026-105832 EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes

EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly...

CVE-2026-107638: Improper Restriction of Excessive Authentication Attempts

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit verificatio...

DRUPAL-CONTRIB-2026-207

This module enables you to add an extra layer of verification for user login flow. The Two Factor Authentication - TFA / Passwordless Login module for Drupal contains a vulnerability in the headless login endpoint that can disclose the site's stored miniOrange customer API key to unauthenticated...

DRUPAL-CONTRIB-2026-201

This module provides TOTP-based two-factor authentication 2FA for Drupal, with an optional setting to enforce 2FA for all users site-wide. The module may allow a user log in with only a password even when site-wide enforcement of 2FA is turned on...

DRUPAL-CONTRIB-2026-197

This module provides TOTP-based two-factor authentication 2FA for Drupal. The module doesn't enforce the second factor when a user logs in with Drupal core's one-time login link. This vulnerability is mitigated by the fact that an attacker must have access to a valid one-time login link for a...

CVE-2026-107180

On MISP instances configured to require TOTP enrolment Security.otprequired, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...

CVE-2026-107180

On MISP instances where Security.otp_required is enabled, a logic flaw allows authenticated users to bypass mandatory TOTP enrolment . The enforcement mechanism only applied to standard browser requests; consequently, users could bypass the setup by issuing non-browser requests such as AJAX/XHR c...

CVE-2026-107180 MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances

On MISP instances configured to require TOTP enrolment Security.otprequired, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...

PT-2026-107499

On MISP instances configured to require TOTP enrolment Security.otp required, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...