CVE-2026-73535

A flaw was found in Gitea. When OpenID Connect sign-in is enabled, the authentication handler verifies a user's password but fails to enforce enrolled second-factor authentication, such as a Time-based One-Time Password TOTP or security key. A remote attacker with knowledge of a victim's password...

CVE-2026-73535

Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtain a session and link an...

PT-2026-108967

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0 through 2.4.9 Description The api/cluster router fails to implement the RequireSecureSession middleware, which is intended to enforce a second-factor OTP One-Time Password step-up for sensitive operations. Consequently,...

CVE-2026-103651 MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypass

MISP contains a vulnerability in its one-time password OTP authentication flow that allows replay of a consumed HOTP paper token and rewinding of the token counter. The HOTP verification logic compared the submitted token against a counter value that was cached in the user's session at the time t...

CVE-2026-96445

A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password OTP should be skipped, but fails to verify if those headers came from a trusted sourc...

CVE-2026-96445

A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password OTP should be skipped, but fails to verify if those headers came from a trusted sourc...

CVE-2026-96445: Improper Authentication

A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password OTP should be skipped, but fails to verify if those headers came from a trusted sourc...

CVE-2026-44196: Improper Authentication

Pingvin Share X is a secure and easy self-hosted file sharing platform. From 1.14.1 to 1.16.2, a critical authentication bypass vulnerability allows an attacker who has obtained a valid username and password to skip the second-factor authentication TOTP requirement entirely. Although, an attacker...

CVE-2021-22057

VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 contain an authentication bypass vulnerability. A malicious actor, who has successfully provided first-factor authentication, may be able to obtain second-factor authentication provided by VMware Verify...

CVE-2020-12812

An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication FortiToken if they changed the case of their username...

EUVD-2019-6574

Malware in sbrugna...

EUVD-2019-16041

Malware in sbrugna...

EUVD-2021-30021

Malicious code in bioql PyPI...

EUVD-2025-6203

Malicious code in bioql PyPI...

EUVD-2023-45258

Malicious code in bioql PyPI...

EUVD-2021-9222

Malicious code in bioql PyPI...

EUVD-2023-44927

Malicious code in bioql PyPI...

CVE-2025-47951 Weblate lacks rate limiting when verifying second factor

Weblate is a web based localization tool. Prior to version 5.12, the verification of the second factor was not subject to rate limiting. The absence of rate limiting on the second factor endpoint allows an attacker with valid credentials to automate OTP guessing. This issue has been patched in...

CVE-2025-47951 Weblate lacks rate limiting when verifying second factor

Weblate is a web based localization tool. Prior to version 5.12, the verification of the second factor was not subject to rate limiting. The absence of rate limiting on the second factor endpoint allows an attacker with valid credentials to automate OTP guessing. This issue has been patched in...

Weblate security vulnerabilities

Weblate is a Copyleft open source web-based free software continuous localization system. A security vulnerability exists in Weblate versions prior to 5.12, which stems from a failure to rate-limit second-factor authentication and could lead to OTP guessing...