CVE-2026-107180

On MISP instances configured to require TOTP enrolment Security.otprequired, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...

Aegis

Aegis Authenticator Aegis Authenticator es una aplicación 2FA gratuita, segura y de código abierto para Android. Su objetivo es proporcionar un autenticador seguro para tus servicios en línea, al mismo tiempo que incluye algunas funcionalidades que faltan en las aplicaciones de autenticación...

totp-ssh-fluxer

TOTP SSH 端口动态变化 有些人会更改自己服务器上的 SSH 端口，以增加自动扫描脚本或恶意程序找到它的难度。虽然这通常被视为一种通过隐藏实现安全的做法，但它确实能有效减少你在 /var/log/auth.log 中常见的大量自动登录尝试。 不过，如果我们能把这件事推向一个荒谬的极端呢？如果我们能使用通常作为第二因素验证码用于登录网站的 TOTP 代码，来实际知道 sshd 服务器正在监听哪个端口呢？ 为此，我带来了 totp-ssh-flux，一种确保你的 sshd 端口每 30 秒变化一次的方法，并可能给你的对手带来短暂的小挫折。 演示： 上面你可以看到我的手机（使用通用 TO...

totp-ssh-fluxer

TOTP SSH port fluxing Some people change their SSH port on their servers so that it is slightly harder to find for bots or other nasties, and while that is generally viewed as an action of security through obscurity it does work very well at killing a lot of the automated logins you always see in...

CVE-2026-105835

PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one...

EUVD-2026-93379

PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one...

CVE-2026-105835

PLANKA versions 2.2.0 through 2.2.1 are vulnerable to a TOTP brute force attack due to a failure to limit incorrect codes submitted to the POST /api/access-tokens/verify-totp endpoint. Attackers who possess a user's password can reuse a ten-minute pending token to repeatedly guess the six-digit c...

CVE-2026-105835 PLANKA 2.2.0 through 2.2.1 TOTP Brute Force via verify-totp Endpoint

PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one...

PT-2026-106717

PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one...

about_cobaltstrike4.5_cdf

aboutcobaltstrike4.5cdf cobaltstrike4.5版本破解、去除checksum8特征、bypass BeaconEye、修复错误路径泄漏stage、增加totp双因子验证、修复CVE-2022-39197等 如果您在寻找这个项目：cobaltstrike4.5cdf 是的它又被封了：Repository unavailable due to DMCA takedown. 如果您对原文中的不涉及软件版权的去除checksum8特征、bypass...

CVE-2021-22911-RocketChat

CVE-2021-22911 — Rocket.Chat 3.12.1 RCE Improvisado Descripción Explota una vulnerabilidad de inyección NoSQL sin autenticación en Rocket.Chat 3.12.1 para filtrar el secreto TOTP del administrador y el token de restablecimiento de contraseña, tomar el control de la cuenta de administrador y logra...

joombrute

JoomBrute Kit moderno de ataques de autenticación para Joomla J3 / J4 / J5 - CVE-2023-23752 · CVE-2023-23755 · CVE-2025-25227 Descripción Kit de ataques de credenciales para Joomla que cubre las versiones 3, 4 y 5 del CMS. Seis subcomandos manejan la cadena de ataque completa de principio a fin:...

zappzarapp-php-security

⚡ zappzarapp/security 全面的 PHP 安全库，提供 CSP、安全响应头、CSRF 防护、安全 Cookie、密码验证、输入净化、速率限制、SRI、密钥加载、加密、会话安全、TOTP 双因素认证、签名 URL 和安全事件日志记录。 亮点 一体化 — 单个可组合包中包含 17 个安全模块 默认安全 — 严格的 CSP，无 unsafe-，HTTPS 优先 框架无关 — 适用于任何 PHP 8.4+ 应用程序 不可变且类型安全 — readonly 类、枚举、with API 质量保障 — PHPStan Level 8、Psalm Level 1、100% Mutati...

cobaltstrike4.5_cdf-1

cobaltstrike4.5cdf cobaltstrike4.5版本破解、去除checksum8特征、bypass BeaconEye、修复错误路径泄漏stage、增加totp双因子验证、增加用户名加密显示、修复4.5版本foreign派生错误的bug、客户端配置文件名字修改等 cobalt strike4.5破解 cobaltstrike4.5破解 TOC 免责声明\免责协议 此工具以及文章内容仅限于安全研究，用户承担因使用此工具以及文章内容而导致的所有法律和相关责任！作者不承担任何法律责任!...

CVE-2026-45332-PoC

CVE-2026-45332: Control de acceso roto en Automad CMS Prueba de concepto para CVE-2026-45332 , una vulnerabilidad de Control de Acceso Roto en Automad CMS que permite a cualquier atacante no autenticado volcar el hash de contraseña bcrypt y el secreto TOTP de todas las cuentas de administrador a...

CVE-2026-103977

Resumen Las versiones de FileRise anteriores a la 3.23.0 almacenaban los intentos fallidos de verificación TOTP en el estado de sesión de PHP. El contador limitaba los intentos dentro de una sesión, pero no persistía entre sesiones recién creadas. Un atacante que ya posee la credencial primaria...

CVE-2026-103514 WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via TOTP Code Replay

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...

[SECURITY] Fedora 45 Update: oath-toolkit-2.6.14-4.fc45

The OATH Toolkit provide components for building one-time password authentication systems. It contains shared libraries, command line tools and a PAM module. Supported technologies include the event-based HOTP algorithm RFC4226 and the time-based TOTP algorithm RFC6238. OATH stands for Open...

TOTPAuthenticate

TOTP Authenticate Utiliza reglas de manejo de sesiones para añadir un token TOTP a las solicitudes salientes. Para Burp Suite Enterprise Edition Tenga en cuenta que las extensiones están escritas por usuarios externos de Burp, y PortSwigger no ofrece ninguna garantía sobre su calidad o utilidad...

protectimus-slim-proxmark3

Script Lua de Proxmark3 para Protectimus SLIM NFC Este script Lua para la plataforma RFID Proxmark3 permite interactuar con el token de hardware de contraseña de un solo uso basada en el tiempo TOTP Protectimus SLIM NFC. Requisitos de hardware Proxmark3 Requisitos de software RRG / Iceman -...