WordPress Hide My WP Ghost plugin <= 7.0.06 - 2FA Bypass vulnerability

2FA Bypass vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Hide My WP Ghost versions = 7.0.06...

CVE-2026-14291

The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced...

CVE-2026-14291

The security-ninja-premium WordPress plugin versions before 5.290 contains a two-factor authentication (2FA) bypass vulnerability. The issue stems from a failure to verify the second authentication factor in one of the plugin's 2FA code paths, specifically via secnin_skip_2fa . This flaw allows a...

CVE-2026-14291 Security Ninja (Premium) < 5.290 - Two-Factor Authentication Bypass via secnin_skip_2fa

The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced...

EUVD-2026-47885

The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced...

CVE-2026-14291

The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced...

CVE-2026-14291 Security Ninja (Premium) < 5.290 - Two-Factor Authentication Bypass via secnin_skip_2fa

The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced...

CVE-2026-15616: Use of Single-factor Authentication

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access...

PT-2026-63574

The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced...

PT-2026-64020

Name of the Vulnerable Software and Affected Versions Logto affected versions not specified Description Logto fails to enforce locally configured Multi-Factor Authentication MFA during Single Sign-On SSO authentication. This flaw allows users to bypass second-factor requirements, potentially...

CVE-2026-14291: Improper Authentication

The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced...

GO-2026-6057 Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface in code.gitea.io/gitea

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth X-Gitea-OTP surface in code.gitea.io/gitea...

CVE-2026-22049

ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication MFA configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could allow an attacker with valid credentials to bypass MFA...

CVE-2026-22049

ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication MFA configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could allow an attacker with valid credentials to bypass MFA...

EUVD-2026-47770

ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication MFA configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could allow an attacker with valid credentials to bypass MFA...

CVE-2026-4773

The CVE-2026-4773 entry covers Magarsus Consulting Ltd. Co. IDM-MFA and describes an improper validation of input type that enables authentication bypass. Affected versions are IDM-MFA from 2025.11.27 up to (but not including) 2026.03.10. The NVD entry lists a CVSS v3.1 base score of 8.1 (High) w...

CVE-2026-4773 OTP Bypass in Magarsus' IDM-MFA

Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass. This issue affects IDM-MFA: from 2025.11.27 before 2026.03.10...

First-Person Identity Theft Story

Harrowing story of an identity theft victim. Yes, the person made a mistake--they gave the scammer a two-factor authentication code that allowed the scammer to take over their email address. But the real story here is how, for many of us, the security of most of our accounts hangs on the security...

Police Dismantle Kratos Phishing Kit Built to Steal Microsoft 365 Sessions and Bypass MFA

German and US law enforcement have taken down the core infrastructure of Kratos , described by German investigators as one of the world's most widely used criminal phishing kits, and Indonesian authorities arrested the man they say developed and ran it. In a joint announcement on Monday, the...

PT-2026-63447

Name of the Vulnerable Software and Affected Versions ONTAP versions 9.16.1 and higher Description An issue exists in the WebAuthn multi-factor authentication MFA configuration related to the Relying Party ID. An attacker possessing valid credentials could exploit this to bypass the MFA process...