CVE-2026-111552

Use of single-factor authentication vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure, Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - dealer integration, and Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - Storefront application and management pan...

EUVD-2026-124376

Use of single-factor authentication vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure, Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - dealer integration, and Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - Storefront application and management pan...

CVE-2026-111552

Hyper Teknoloji Ltd. Şti. products are susceptible to an Authentication Bypass due to a Use of single-factor Authentication vulnerability (CWE-307). This issue affects the Hyper E-Commerce Infrastructure (versions before 1.1), the dealer integration (versions before 1.2), and the Storefront appli...

CVE-2026-111552 Multi-Factor Authentication Bypass in Hyper Technology's Hyper E-Commerce Infrastructure

Use of single-factor authentication vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure, Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - dealer integration, and Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - Storefront application and management pan...

SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability

SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication MFA...

EUVD-2026-116530

A vulnerability has been found in Umami 3.3.x/3.4.0/3.4.1. This affects an unknown part of the file src/app/api/auth/login/route.ts of the component 2FA Policy Handler. The manipulation leads to use of single-factor authentication. It is possible to initiate the attack remotely. The exploit has...

CVE-2026-121531

A vulnerability has been found in Umami 3.3.x/3.4.0/3.4.1. This affects an unknown part of the file src/app/api/auth/login/route.ts of the component 2FA Policy Handler. The manipulation leads to use of single-factor authentication. It is possible to initiate the attack remotely. The exploit has...

CVE-2026-121531

A vulnerability exists in Umami versions 3.3.x, 3.4.0, and 3.4.1 within the 2FA Policy Handler component. Specifically, an issue in the file src/app/api/auth/login/route.ts allows for manipulation that results in the use of single-factor authentication . This vulnerability can be initiated remote...

CVE-2026-121531 Umami 2FA Policy route.ts single-factor authentication

A vulnerability has been found in Umami 3.3.x/3.4.0/3.4.1. This affects an unknown part of the file src/app/api/auth/login/route.ts of the component 2FA Policy Handler. The manipulation leads to use of single-factor authentication. It is possible to initiate the attack remotely. The exploit has...

CVE-2026-121531 Umami 2FA Policy route.ts single-factor authentication

A vulnerability has been found in Umami 3.3.x/3.4.0/3.4.1. This affects an unknown part of the file src/app/api/auth/login/route.ts of the component 2FA Policy Handler. The manipulation leads to use of single-factor authentication. It is possible to initiate the attack remotely. The exploit has...

Use of Single-factor Authentication

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Use of Single-factor Authentication via UserController::updateData api/user/data/update, which does not require the current password when changing an...

Use of Single-factor Authentication

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Use of Single-factor Authentication via UserController::updateData api/user/data/update, which does not require the current password when changing an...

CVE-2026-111884: Use of Single-factor Authentication

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...

CVE-2026-57490: Use of Single-factor Authentication

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username and password through AuthModel::authenticate and does not...

CVE-2026-79763

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints accept the account password as the sole reauthentication factor after a 2.4.0 refactor...

CVE-2026-79763 Termix: MFA-critical operations accept the account password as a sole factor (regression of CVE-2026-45749)

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints accept the account password as the sole reauthentication factor after a 2.4.0 refactor...

CVE-2026-79763 Termix: MFA-critical operations accept the account password as a sole factor (regression of CVE-2026-45749)

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints accept the account password as the sole reauthentication factor after a 2.4.0 refactor...

CVE-2026-79763

The web-based server management platform Termix (versions 2.4.0 through 2.5.1) is vulnerable to a regression that allows MFA-critical operations to be performed using only an account password. Specifically, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints in src/backend/da...

CVE-2026-79763 Termix: MFA-critical operations accept the account password as a sole factor (regression of CVE-2026-45749)

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints accept the account password as the sole reauthentication factor after a 2.4.0 refactor...

EUVD-2026-86120

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints accept the account password as the sole reauthentication factor after a 2.4.0 refactor...