6236 matches found
CVE-2026-103655
MISP contains a vulnerability in its two-factor authentication TOTP verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow where a TOTP code is verified as a second authentication factor...
CVE-2026-103651
MISP contains a vulnerability in its one-time password OTP authentication flow that allows replay of a consumed HOTP paper token and rewinding of the token counter. The HOTP verification logic compared the submitted token against a counter value that was cached in the user's session at the time t...
CVE-2026-103655 MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period
MISP contains a vulnerability in its two-factor authentication TOTP verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow where a TOTP code is verified as a second authentication factor...
EUVD-2026-90550
MISP contains a vulnerability in its two-factor authentication TOTP verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow where a TOTP code is verified as a second authentication factor...
CVE-2026-103655 MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period
MISP contains a vulnerability in its two-factor authentication TOTP verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow where a TOTP code is verified as a second authentication factor...
CVE-2026-103651 MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypass
MISP contains a vulnerability in its one-time password OTP authentication flow that allows replay of a consumed HOTP paper token and rewinding of the token counter. The HOTP verification logic compared the submitted token against a counter value that was cached in the user's session at the time t...
CVE-2026-76143 Genians, Inc Genian SSL PNS Multi Factor Authentication Bypass
A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter...
CVE-2026-76143 Genians, Inc Genian SSL PNS Multi Factor Authentication Bypass
A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter...
EUVD-2026-90485
A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter...
PT-2026-104009
Name of the Vulnerable Software and Affected Versions Filament versions 4.0.0 through 4.13.2 Filament versions 5.0.0 through 5.8.2 Description App-based multi-factor authentication MFA management actions do not consistently require confirmation of the current password. An attacker with access to ...
PT-2026-103734
Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.48 Description A flaw in the two-factor authentication TOTP verification process allows a valid one-time code to be accepted multiple times within its time-based validity window, typically 30 seconds. This occurs...
PT-2026-103815
Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only the password, bypassing two-factor authentication. Attackers with valid staff credentials can exploit improper session management to...
PT-2026-103713
MISP contains a vulnerability in its one-time password OTP authentication flow that allows replay of a consumed HOTP paper token and rewinding of the token counter. The HOTP verification logic compared the submitted token against a counter value that was cached in the user's session at the time t...
CVE-2026-103655: Authentication Bypass by Capture-replay
MISP contains a vulnerability in its two-factor authentication TOTP verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow where a TOTP code is verified as a second authentication factor...
CVE-2026-103283: Insufficient Session Expiration
Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only the password, bypassing two-factor authentication. Attackers with valid staff credentials can exploit improper session management to...
CVE-2026-104181: Missing Authentication for Critical Function
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3, app-based multi-factor authentication management actions do not consistently require confirmation of the current password. An attacker with access to an authenticated user...
CVE-2026-100508
Unauthenticated Denial of Service Attack in Two Factor = 0.16.0 versions...
CVE-2026-100508 WordPress Two Factor plugin <= 0.16.0 - Denial of Service Attack vulnerability
Unauthenticated Denial of Service Attack in Two Factor = 0.16.0 versions...
