CVE-2025-31694 Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2025-023

Incorrect Authorization vulnerability in Drupal Two-factor Authentication TFA allows Forceful Browsing.This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.10.0...

CVE-2025-31694 Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2025-023

Incorrect Authorization vulnerability in Drupal Two-factor Authentication TFA allows Forceful Browsing.This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.10.0...

CVE-2025-31694

The Drupal Two-factor Authentication (TFA) module is vulnerable to an incorrect authorization flaw, which allows for Forceful Browsing . This security issue affects all versions from 0.0.0 before 1.10.0 . The vulnerability is categorized under CWE-288 , identifying it as an authentication bypass ...

Drupal Two-factor Authentication security vulnerability

Drupal Two-factor Authentication is a module for the Drupal community. A security vulnerability exists in Drupal Two-factor Authentication versions prior to 1.10.0, which stems from incorrect authorization and could lead to forced browsing...

PT-2025-13864 · Drupal · Drupal Two-Factor Authentication

Name of the Vulnerable Software and Affected Versions: Drupal Two-factor Authentication TFA versions 0.0.0 through 1.10.0 Description: The issue is related to an Incorrect Authorization vulnerability in the Drupal Two-factor Authentication TFA module, allowing Forceful Browsing. Recommendations:...

CVE-2025-31694: Authentication Bypass Using an Alternate Path or Channel

Incorrect Authorization vulnerability in Drupal Two-factor Authentication TFA allows Forceful Browsing.This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.10.0...

USN-7354-1 djoser vulnerability

Diego Cebrián discovered that djoser did not properly handle user authentication. An attacker with valid credentials could possibly use this to bypass authentication checks, such as two-factor authentication, to gain unintended access...

USN-7354-1: djoser vulnerability

Diego Cebrián discovered that djoser did not properly handle user authentication. An attacker with valid credentials could possibly use this to bypass authentication checks, such as two-factor authentication, to gain unintended access...

CVE-2025-29996

This vulnerability exists in the CAP back office application due to improper implementation of OTP verification mechanism in its API based login. A remote attacker with valid credentials could exploit this vulnerability by manipulating API request URL/payload. Successful exploitation of this...

FBI and CISA Urge Enabling 2FA to Counter Medusa Ransomware

FBI and CISA warn of Medusa ransomware attacks impacting critical infrastructure. Learn about Medusa's tactics, prevention tips, and…...

CVE-2025-29996

This vulnerability exists in the CAP back office application due to improper implementation of OTP verification mechanism in its API based login. A remote attacker with valid credentials could exploit this vulnerability by manipulating API request URL/payload. Successful exploitation of this...

CVE-2025-29996 Authentication Bypass Vulnerability in CAP back office application

This vulnerability exists in the CAP back office application due to improper implementation of OTP verification mechanism in its API based login. A remote attacker with valid credentials could exploit this vulnerability by manipulating API request URL/payload. Successful exploitation of this...

CVE-2025-29996

CVE-2025-29996 affects the CAP back office application. The issue is an improper implementation of the OTP verification in the API-based login, allowing a remote attacker with valid credentials to manipulate API requests to bypass 2FA for other user accounts. The core vulnerability is in the OTP/...

CVE-2025-29996 Authentication Bypass Vulnerability in CAP back office application

This vulnerability exists in the CAP back office application due to improper implementation of OTP verification mechanism in its API based login. A remote attacker with valid credentials could exploit this vulnerability by manipulating API request URL/payload. Successful exploitation of this...

WordPress Really Simple SSL 9.0.0 Authentication Bypass

WordPress Really Simple SSL plugin version 9.0.0 proof of concept 2FA bypass that allows the uploading of a malicious plugin. ============================================================================================================================================= | Title : WordPress Really...

CVE-2025-29996: Authentication Bypass Using an Alternate Path or Channel

This vulnerability exists in the CAP back office application due to improper implementation of OTP verification mechanism in its API based login. A remote attacker with valid credentials could exploit this vulnerability by manipulating API request URL/payload. Successful exploitation of this...

Exploit for Missing Authentication for Critical Function in Really-Simple-Plugins Really_Simple_Security

CVE-2024-10924 CVE-2024-10924 - Authentication Bypass in Reall...

Android botnet BadBox largely disrupted

Removing 24 malicious apps from the Google Play store and silencing some servers almost halved a botnet known as BadBox. The BadBox botnet focuses on Android devices, but not just phones. It also affects other devices like TV streaming boxes, tablets, and smart TVs. The German BSI Federal Office...

CVE-2025-25450

TAAGSOLUTIONS GmbH MyTaag versions prior to v.2024-11-24 are vulnerable to a privilege escalation issue. A remote attacker can escalate privileges by deactivating the activated second factor via the /session endpoint. To mitigate this risk, it is recommended to disable access to the /session endp...

DRUPAL-CONTRIB-2025-023

This module enables you to allow and/or require users to use a second authentication method in addition to password authentication. The module does not sufficiently ensure that known login routes are not overridden by third-party modules which can allow an access bypass to occur. This vulnerabili...