1201 matches found
Malicious code in discord-mfa-solver (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a91086c84ad0836c4b32ee5db890c9a6d9543f00e9dd31d18aed8a6acc9bdb3e On require of the package, lib/cache.js reached from index.js executes trymodule'require'catch — a bracket-notation, error-swallowed dynamic require ...
MAL-2026-16100 Malicious code in discord-mfa-solver (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a91086c84ad0836c4b32ee5db890c9a6d9543f00e9dd31d18aed8a6acc9bdb3e On require of the package, lib/cache.js reached from index.js executes trymodule'require'catch — a bracket-notation, error-swallowed dynamic require ...
Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA
Cybercriminals are hijacking artificial intelligence AI user accounts via information stealer logs to create "stolen keys" that grant illicit access to tools from model providers like Google, Anthropic, and others. Information stealers like Lumma Stealer or Vidar are equipped to harvest a wide...
CVE-2026-78629
The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication...
CVE-2026-78631 Improper Restriction of Sensitive Information in Okta Hyperdrive Agent Logging
The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access t...
CVE-2026-78631
Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This improper restriction of sensitive information makes a live authentication credential readable by any local user with access to that log ...
EUVD-2026-74183
The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access t...
CVE-2026-78631 Improper Restriction of Sensitive Information in Okta Hyperdrive Agent Logging
The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access t...
CVE-2026-78629 Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling
The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication...
CVE-2026-78629 Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling
The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication...
CVE-2026-78629
The Okta Hyperdrive agent plugin contains an improper authentication verification flaw in its MFA response handling. When an organization's policy does not require MFA for a given user, the plugin returns a success response that contains only a bare boolean validation indicator rather than a sign...
Exploit for CVE-2026-73313
CVE-2026-73313 XenForo before 2.3.13 can complete one user's...
CVE-2026-73313
XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete login as another user by submitting their own registered passkey credential during the WebAuthn assertion step. The passkey verification...
CVE-2026-73313 XenForo < 2.3.13 MFA Bypass via Passkey TFA Provider
XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete login as another user by submitting their own registered passkey credential during the WebAuthn assertion step. The passkey verification...
CVE-2026-73313
XenForo versions before 2.3.13 contain an MFA bypass vulnerability in the passkey TFA provider . During the WebAuthn assertion step, the passkey verification path performs a global credential lookup without validating that the matched credential belongs to the user whose login is pending. This al...
EUVD-2026-72784
XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete login as another user by submitting their own registered passkey credential during the WebAuthn assertion step. The passkey verification...
CVE-2026-73313 XenForo < 2.3.13 MFA Bypass via Passkey TFA Provider
XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete login as another user by submitting their own registered passkey credential during the WebAuthn assertion step. The passkey verification...
PT-2026-88441
Name of the Vulnerable Software and Affected Versions Okta Hyperdrive Agent affected versions not specified Description The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level following every successful MFA completion. This...
PT-2026-87058
Name of the Vulnerable Software and Affected Versions XenForo versions prior to 2.3.13 Description A multi-factor authentication bypass exists in the passkey TFA provider. An authenticated attacker who possesses a target account's password can bypass multi-factor authentication on both the public...
