CVE-2026-18967

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused asserti...

EUVD-2025-210622

My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass authentication and gain unauthorized access to user accounts via predictable OTP values...

CVE-2026-15210

The CVE-2026-15210 entry concerns the WordPress plugin “OTP Login With Phone Number, OTP Verification” (before version 1.8.71). The vulnerability is that the plugin does not limit OTP verification attempts or invalidate a one-time code after a wrong guess, allowing an unauthenticated user to requ...

EUVD-2026-53117

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeri...

CVE-2025-63823

The CVE-2025-63823 entry affects My Safetipin Android Application version 5.2.1, where hardcoded credentials in the authentication module enable remote attackers to bypass authentication and gain unauthorized access to user accounts through predictable OTP values. The root cause is the hardcoded ...

CVE-2025-63823

My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass authentication and gain unauthorized access to user accounts via predictable OTP values...

CVE-2026-16035

CVE-2026-16035 affects the miniOrange 2FA WordPress plugin prior to version 6.2.7. The vulnerability arises because the plugin does not restrict who can trigger the second-factor configuration OTP send, nor does it bind the OTP recipient to the enrolling user’s address. As a result, a low-privile...

CVE-2026-16035 miniOrange 2FA < 6.2.7 - Subscriber+ Arbitrary-Recipient OTP Send

The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the...

CVE-2026-15206

CVE-2026-15206 affects the SMS Alert WordPress plugin (before 3.9.8). The vulnerability arises because the plugin does not bind the mobile verified session flag to the actually verified phone number. After an attacker verifies an OTP on their own number, the signup/login handler reads an attacker...

PT-2026-67061

The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and...

CVE-2026-67327

better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...

CVE-2026-14561

The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered...

CVE-2026-14561 Authora - Easy Login with Mobile Number < 1.7.7 - Unauthenticated Account Takeover via OTP Disclosure

The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered...

CVE-2026-14561

The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered...

CVE-2026-14561

The CVE-2026-14561 entry concerns the Authora WordPress plugin (versions before 1.7.7). The vulnerability arises because the plugin does not keep the one-time login code confidential, returning the OTP and a valid verification token in the response of an unauthenticated action. This allows unauth...

EUVD-2026-51708

The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered...

CVE-2026-14309

CVE-2026-14309 affects the WordPress plugin “Chat On Desk Order Notifications” prior to 1.0.9. The issue is an OTP bypass: the plugin does not verify that the one-time password has been validated before processing a password-reset request, allowing unauthenticated attackers to reset passwords for...

EUVD-2026-51721

The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, and take over their...

CVE-2026-14309

The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, and take over their...

CVE-2026-14309 Chat On Desk < 1.0.9 - Unauthenticated Account Takeover via Password Reset OTP Bypass

The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, and take over their...