CVE-2026-103514

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...

EUVD-2026-91934

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...

CVE-2026-103514 WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via TOTP Code Replay

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...

CVE-2026-103514

The WP 2FA WordPress plugin, in versions prior to 4.1.0 , is vulnerable to a two-factor authentication bypass. The root cause is the failure to invalidate a time-based one-time passcode (TOTP) after its initial use. An attacker who possesses an account's password and observes a valid code within ...

CVE-2026-103514 WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via TOTP Code Replay

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...

CVE-2024-10924-Bypass-MFA-Wordpress-LAB

CVE-2024-10924 WordPress MFA 우회 - 익스플로잇 랩 이 저장소는 WordPress에서 CVE-2024-10924 취약점을 악용하여 이중 인증MFA을 우회하고 WordPress 관리 패널에 접근하기 위한 랩을 제공합니다. 전제 조건 이 랩을 환경에 배포하려면 아래 단계를 따르세요: VMware에 WordPress 배포 LAB의 zip 파일을 압축 해제한 후, VMWare에서 Open을 클릭하여 머신을 가져와야 합니다. Ubuntu-Bypass-MFA-Wordpress.vmx라는 파일을 선택하고, 마지막으로...

CVE-2026-103514: Improper Authentication

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...

PT-2026-104520

Name of the Vulnerable Software and Affected Versions WP 2FA WordPress plugin versions prior to 4.1.0 Description The plugin fails to invalidate a time-based one-time passcode after its initial use. This allows an attacker who possesses a user's password and has intercepted a valid code during it...

CVE-2026-103880 Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP server that supports this algorithm will cause the server CPU to run for hours checking the credentials. A bounded cost should be enforced...

ReelPhish

ReelPhish 사용 지침: 이 도구는 FireEye 블로그 게시물과 함께 출시되었습니다. 블로그 게시물은 다음 링크에서 확인할 수 있습니다: https://www.fireeye.com/blog/threat-research/2018/02/reelphish-real-time-two-factor-phishing-tool.html 설치 단계 1. Python 2.7.x의 최신 릴리스가 필요합니다. 2. 브라우저 드라이버를 실행하는 데 필요한 종속성인 Selenium을 설치합니다. pip install -r...

CVE-2026-104181

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3, app-based multi-factor authentication management actions do not consistently require confirmation of the current password. An attacker with access to an authenticated user...

CVE-2026-104181 Filament: Multi-factor authentication (app) management actions do not require password reauthentication

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3, app-based multi-factor authentication management actions do not consistently require confirmation of the current password. An attacker with access to an authenticated user...

CVE-2026-104181 Filament: Multi-factor authentication (app) management actions do not require password reauthentication

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3, app-based multi-factor authentication management actions do not consistently require confirmation of the current password. An attacker with access to an authenticated user...

CVE-2026-104181

The Filament full-stack components for Laravel are vulnerable in versions 4.0.0 through 4.13.3 and 5.8.3 . The root cause is that app-based multi-factor authentication (MFA) management actions do not consistently require the current password for confirmation. An attacker with access to an authent...

CVE-2026-104181 Filament: Multi-factor authentication (app) management actions do not require password reauthentication

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3, app-based multi-factor authentication management actions do not consistently require confirmation of the current password. An attacker with access to an authenticated user...

CVE-2026-103283

Ghost versions 6.20.0 before 6.57.1 are affected by a session handling vulnerability. This flaw allows authenticated staff users to log in as any other staff member by providing only a password, effectively bypassing two-factor authentication . Attackers with valid staff credentials can exploit t...

CVE-2026-103283 Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling

Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only the password, bypassing two-factor authentication. Attackers with valid staff credentials can exploit improper session management to...

EUVD-2026-90676

Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only the password, bypassing two-factor authentication. Attackers with valid staff credentials can exploit improper session management to...

CVE-2026-103283 Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling

Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only the password, bypassing two-factor authentication. Attackers with valid staff credentials can exploit improper session management to...

CVE-2026-103283 Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling

Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only the password, bypassing two-factor authentication. Attackers with valid staff credentials can exploit improper session management to...