PT-2026-58994

Summary Two-factor authentication TOTP can be fully bypassed for the REST API. The KIMAI SESSION cookie returned in the response to the login request; issued after only the password is verified, before the TOTP step; is already accepted as authenticated by every /api/ endpoint. So after submittin...

DRUPAL-CONTRIB-2025-063

This module enables you to allow users to include a second authentication method in addition to password authentication. The module doesn't sufficiently prevent the same TFA token within a 30 second window. This vulnerability is mitigated by the fact that an attacker must obtain a valid...

PT-2005-1543 · Rsa +1 · Rsa Securid +2

Name of the Vulnerable Software and Affected Versions: Tarantella Secure Global Desktop Enterprise Edition versions 3.42 through 4.00 Tarantella Enterprise 3 versions 3.30 through 3.40 Description: The issue reveals sensitive information during authentication when multiple users have the same...