hotpot

Hotpot 🍲 Authy / Google Authenticator for the command line. Hotpot is a simple and secure command-line tool for managing TOTP-based two-factor authentication codes. Hotpot securely stores your 2FA secrets in your system's keyring and generates time-based one-time passwords when you need them. Bui...

DRUPAL-CONTRIB-2026-207

This module enables you to add an extra layer of verification for user login flow. The Two Factor Authentication - TFA / Passwordless Login module for Drupal contains a vulnerability in the headless login endpoint that can disclose the site's stored miniOrange customer API key to unauthenticated...

DRUPAL-CONTRIB-2026-201

This module provides TOTP-based two-factor authentication 2FA for Drupal, with an optional setting to enforce 2FA for all users site-wide. The module may allow a user log in with only a password even when site-wide enforcement of 2FA is turned on...

DRUPAL-CONTRIB-2026-197

This module provides TOTP-based two-factor authentication 2FA for Drupal. The module doesn't enforce the second factor when a user logs in with Drupal core's one-time login link. This vulnerability is mitigated by the fact that an attacker must have access to a valid one-time login link for a...

CVE-2026-107180

On MISP instances configured to require TOTP enrolment Security.otprequired, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...

CVE-2026-107180 MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances

On MISP instances configured to require TOTP enrolment Security.otprequired, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...

CVE-2026-107180

On MISP instances where Security.otp_required is enabled, a logic flaw allows authenticated users to bypass mandatory TOTP enrolment . The enforcement mechanism only applied to standard browser requests; consequently, users could bypass the setup by issuing non-browser requests such as AJAX/XHR c...

Really Simple Security < 9.1.2 - Authentication Bypass

The Really Simple Security Free, Pro, and Pro Multisite plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'checkloginandgetuser' function. This makes it possible...

2FA-Bypass-using-a-Brute-Force-Attack-CVE-2025-60424

2FA Bypass Using a Brute Force Attack Overview The Nagios Fusion application version 2024R1.2 and 2024R2 is vulnerable to a Brute-Force attack on its Two-Factor Authentication 2FA mechanism. Specifically, the 2FA implementation does not adequately enforce rate-limiting or account lockout...

PT-2026-107759

This module enables you to add an extra layer of verification for user login flow. The Two Factor Authentication - TFA / Passwordless Login module for Drupal contains a vulnerability in the headless login endpoint that can disclose the site's stored miniOrange customer API key to unauthenticated...

PT-2026-107752

This module provides TOTP-based two-factor authentication 2FA for Drupal, with an optional setting to enforce 2FA for all users site-wide. The module may allow a user log in with only a password even when site-wide enforcement of 2FA is turned on...

Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

This module enables you to add an extra layer of verification for user login flow. The Two Factor Authentication - TFA / Passwordless Login module for Drupal contains a vulnerability in the headless login endpoint that can disclose the site's stored miniOrange customer API key to unauthenticated...

PT-2026-107747

This module provides TOTP-based two-factor authentication 2FA for Drupal. The module doesn't enforce the second factor when a user logs in with Drupal core's one-time login link. This vulnerability is mitigated by the fact that an attacker must have access to a valid one-time login link for a...

PT-2026-107499

On MISP instances configured to require TOTP enrolment Security.otp required, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...

GHSA-Q6MQ-CH85-C8MM Payload: Password hashes use insufficient PBKDF2 iterations

Impact The password-hashing configuration used a lower work factor than what is recommended. Patches Payload now uses stronger password-hashing parameters and transparently upgrades older hashes following a successful login. Users should upgrade Payload packages to = 3.90.0 or = 4.0.0-canary.34...

Payload: Password hashes use insufficient PBKDF2 iterations

Impact The password-hashing configuration used a lower work factor than what is recommended. Patches Payload now uses stronger password-hashing parameters and transparently upgrades older hashes following a successful login. Users should upgrade Payload packages to = 3.90.0 or = 4.0.0-canary.34...

POC-CVE-2026-18963

CVE-2026-18963 — Keycloak Forgot-Password Flow Authentication Bypass PoC Proof of Concept for CVE-2026-18963 , a flaw in Keycloak's "Forgot Password" / credential-selection flow that allows an attacker to reach the UPDATEPASSWORD step — and reset a target account's password — without properly...

CVE-2026-105804 Payload: Password hashes use insufficient PBKDF2 iterations

Payload is a free and open source headless content management system. Payload versions from 3.0.0 before 3.90.0 and canary versions from 4.0.0-canary.0 before 4.0.0-canary.34 use a lower-than-recommended PBKDF2 work factor for password hashing, reducing the computational effort required to test...

CVE-2026-105835

PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one...

CVE-2026-105835 PLANKA 2.2.0 through 2.2.1 TOTP Brute Force via verify-totp Endpoint

PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one...