CVE-2026-126729

This module enables you to require a second authentication factor a time-based one-time password from an authenticator app when users log in. The module doesn't sufficiently enforce the second factor for authentication providers that authenticate every request on their own. An attacker who knows...

POC-CVE-2026-18963

CVE-2026-18963 — Keycloak Forgot-Password Flow Authentication Bypass PoC Proof of Concept for CVE-2026-18963 , a flaw in Keycloak's "Forgot Password" / credential-selection flow that allows an attacker to reach the UPDATEPASSWORD step — and reset a target account's password — without properly...

CVE-2026-123697

The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current two-factor code or two-factor secret, allowing unauthenticated users to obtain them for any account and bypass the second factor on sites where its one-time password library is availabl...

CVE-2026-123697 Security For WooCommerce <= 1.0.16 - Unauthenticated Two-Factor Code and Secret Disclosure

The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current two-factor code or two-factor secret, allowing unauthenticated users to obtain them for any account and bypass the second factor on sites where its one-time password library is availabl...

EUVD-2026-123201

The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current two-factor code or two-factor secret, allowing unauthenticated users to obtain them for any account and bypass the second factor on sites where its one-time password library is availabl...

PT-2026-145036

The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current two-factor code or two-factor secret, allowing unauthenticated users to obtain them for any account and bypass the second factor on sites where its one-time password library is availabl...

CVE-2026-123697: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current…

The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current two-factor code or two-factor secret, allowing unauthenticated users to obtain them for any account and bypass the second factor on sites where its one-time password library is availabl...

PT-2026-145645

This module enables you to require a second authentication factor a time-based one-time password from an authenticator app when users log in. The module doesn't sufficiently enforce the second factor for authentication providers that authenticate every request on their own. An attacker who knows...

keycloak-services: keycloak-services: Conditional OTP skip-header policy evaluated against untrusted proxy headers

A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password OTP should be skipped, but fails to verify if those headers came from a trusted sourc...

CVE-2026-119215 AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account

Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ashauthentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor...

CVE-2026-119215

The team-alembic ash_authentication library is vulnerable to an Authorization Bypass Through User-Controlled Key (CWE-639) in versions 5.0.0-rc.0 before 5.0.0-rc.16 . The root cause is that AshAuthentication.Strategy.Totp.ConfirmSetupChange fails to verify that a setup token was issued to the spe...

CVE-2026-115829

In Secret Server on-prem versions earlier than 12.3.1, a user could cause a two-factor pin code to be generated for any account without prior authentication, then bypass the initial login step and authenticate using the second factor alone...

CVE-2026-115829

Delinea Secret Server on-prem versions earlier than 12.3.1 are vulnerable to an authorization issue allowing an authentication bypass. An attacker can trigger the generation of a two-factor pin code for any account without prior authentication. By subsequently negotiating only the second factor l...

EUVD-2026-114374

In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only...

CVE-2026-115829 Secret Server Authentication Bypass via Unauthenticated Pin Code Reset and Brute Force

In Secret Server on-prem versions earlier than 12.3.1, a user could cause a two-factor pin code to be generated for any account without prior authentication, then bypass the initial login step and authenticate using the second factor alone...

CVE-2026-115829 Secret Server Authentication Bypass via Unauthenticated Pin Code Reset and Brute Force

In Secret Server on-prem versions earlier than 12.3.1, a user could cause a two-factor pin code to be generated for any account without prior authentication, then bypass the initial login step and authenticate using the second factor alone...

CVE-2026-115829: Delinea Secret Server: In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by…

In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only...

PT-2026-134148

Name of the Vulnerable Software and Affected Versions Secret Server versions prior to 12.3.1 Description An authentication bypass exists where a user can trigger the generation of a two-factor pin code for any account without first authenticating. This allows the user to skip the initial login...

Linux Distros Unpatched Vulnerability : CVE-2026-107145

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The twofactorgauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who...

CVE-2026-107145

The twofactorgauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system. This...