EUVD-2026-54204

The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code...

CVE-2026-16619

The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code...

CVE-2026-16619 miniOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor Attempts

The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code...

CVE-2026-16619

The CVE-2026-16619 entry affects the miniOrange 2FA WordPress plugin, specifically versions before 6.2.8. The vulnerability arises because the plugin does not properly limit second-factor verification attempts; it tracks attempts using a client-supplied identifier that is reissued on every login,...

CVE-2025-13909 Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure

The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable...

CVE-2026-14204

The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in user into overwriting their own 2FA secret with an attacker-controlled value, which enables two-factor authentication and locks the victim o...

Snowflake Hacker Pleads Guilty Over Breaches Affecting at Least 100 Million People

Connor Riley Moucka pleaded guilty in Seattle federal court on Wednesday to computer fraud, wire fraud, aggravated identity theft and a related conspiracy over the 2024 breaches of Snowflake customer accounts. The intrusions reached at least 165 organizations and exposed records belonging to at...

EUVD-2026-53738

The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in user into overwriting their own 2FA secret with an attacker-controlled value, which enables two-factor authentication and locks the victim o...

CVE-2026-14204

The CVE-2026-14204 entry concerns the Google Authenticator WordPress plugin prior to version 0.56. The flaw is that the plugin does not verify a CSRF nonce when saving its two-factor setup, enabling a logged-in attacker to overwrite the user’s 2FA secret with attacker-controlled data. This can en...

CVE-2026-14204 Google Authenticator < 0.56 - 2FA Secret Overwrite via CSRF

The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in user into overwriting their own 2FA secret with an attacker-controlled value, which enables two-factor authentication and locks the victim o...

CVE-2026-71293

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the twofactorrecoverycodes handle that returns the user's raw two-factor recovery codes with no access restriction: if $handle === 'twofactorrecoverycodes' return new...

CVE-2026-71293 Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the twofactorrecoverycodes handle that returns the user's raw two-factor recovery codes with no access restriction: if $handle === 'twofactorrecoverycodes' return new...

CVE-2026-71293

CVE-2026-71293 (Statamic CMS) : The AugmentedUser::get() handler exposes a dedicated case for the two_factor_recovery_codes handle, returning raw 2FA recovery codes without access restrictions. This bypass is not mitigated by password-hash exclusions, and two_factor_recovery_codes is not protecte...

EUVD-2026-53378

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the twofactorrecoverycodes handle that returns the user's raw two-factor recovery codes with no access restriction: if $handle === 'twofactorrecoverycodes' return new...

CVE-2026-54418

Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter with no ownership check, session pinning, or permission-attribute gate unlike other RPC-exposed methods in the sa...

CVE-2026-15372

The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator...

CVE-2026-16036

The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing factor, allowing an attacker who knows a user's password to rebind that user's second factor to an attacker-controlled...

CVE-2026-54418

CVE-2026-54418 affects Leantime up to version 3.6.2. The JSON-RPC endpoints leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA accept a caller-supplied userId without ownership checks, session pinning, or permission-attribute gating. An authenticated user can call ...

EUVD-2026-53193

Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter with no ownership check, session pinning, or permission-attribute gate unlike other RPC-exposed methods in the sa...

CVE-2026-54418 Leantime: Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and Bypass

Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter with no ownership check, session pinning, or permission-attribute gate unlike other RPC-exposed methods in the sa...