1579 matches found
CVE-2026-10697 MFA Bypass in MOVEit Transfer
Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3...
CVE-2026-15616
Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access...
CVE-2026-15616 Local MFA not enforced during SSO sign-in
Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access...
EUVD-2026-48301
Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access...
CVE-2026-15616 Local MFA not enforced during SSO sign-in
Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access...
CVE-2026-15616
The Logto identity and access management platform fails to enforce locally configured Multi-Factor Authentication (MFA) during Single Sign-On (SSO) authentication. The vulnerability occurs when hasVerifiedSsoIdentity is true, allowing an attacker with a federated identity from a permissive upstre...
CVE-2026-15616 Local MFA not enforced during SSO sign-in
Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access...
PT-2026-64020
Name of the Vulnerable Software and Affected Versions Logto affected versions not specified Description Logto fails to enforce locally configured Multi-Factor Authentication MFA during Single Sign-On SSO authentication. This flaw allows users to bypass second-factor requirements, potentially...
CVE-2026-22049
ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication MFA configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could allow an attacker with valid credentials to bypass MFA...
CVE-2026-22049
ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication MFA configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could allow an attacker with valid credentials to bypass MFA...
EUVD-2026-47770
ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication MFA configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could allow an attacker with valid credentials to bypass MFA...
CVE-2026-4773
The CVE-2026-4773 entry covers Magarsus Consulting Ltd. Co. IDM-MFA and describes an improper validation of input type that enables authentication bypass. Affected versions are IDM-MFA from 2025.11.27 up to (but not including) 2026.03.10. The NVD entry lists a CVSS v3.1 base score of 8.1 (High) w...
CVE-2026-4773 OTP Bypass in Magarsus' IDM-MFA
Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass. This issue affects IDM-MFA: from 2025.11.27 before 2026.03.10...
Police Dismantle Kratos Phishing Kit Built to Steal Microsoft 365 Sessions and Bypass MFA
German and US law enforcement have taken down the core infrastructure of Kratos , described by German investigators as one of the world's most widely used criminal phishing kits, and Indonesian authorities arrested the man they say developed and ran it. In a joint announcement on Monday, the...
PT-2026-63366
Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass. This issue affects IDM-MFA: from 2025.11.27 before 2026.03.10...
PT-2026-63447
Name of the Vulnerable Software and Affected Versions ONTAP versions 9.16.1 and higher Description An issue exists in the WebAuthn multi-factor authentication MFA configuration related to the Relying Party ID. An attacker possessing valid credentials could exploit this to bypass the MFA process...
Device Code Phishing: Turning a Convenience Feature Into an MFA Bypass
Device code phishing abuses a legitimate authentication feature designed for devices with limited input capabilities. This article breaks down how the technique works, examines a recent observed case, and outlines the layered security measures organizations can implement...
CVE-2026-3183
Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass...