EUVD-2026-51436

The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor...

CVE-2026-12695

CVE-2026-12695 concerns the miniOrange 2FA WordPress plugin (pre-6.2.6). The vulnerability arises because the plugin does not validate the submitted one-time password (OTP) against the targeted user’s stored secret; instead it verifies the OTP against an attacker-supplied value. This enables an u...

CVE-2026-12703

TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that can allow an authenticated attacker to bypass a configured 2FA for Connections approval flow via Unattended Access and establish a remote connection to an affected macOS host...

EUVD-2026-50360

TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that can allow an authenticated attacker to bypass a configured 2FA for Connections approval flow via Unattended Access and establish a remote connection to an affected macOS host...

CVE-2026-12703 Bypass of 2FA for Connections via Unattended Access in TeamViewer for macOS

TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that can allow an authenticated attacker to bypass a configured 2FA for Connections approval flow via Unattended Access and establish a remote connection to an affected macOS host...

CVE-2026-12703 Bypass of 2FA for Connections via Unattended Access in TeamViewer for macOS

TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that can allow an authenticated attacker to bypass a configured 2FA for Connections approval flow via Unattended Access and establish a remote connection to an affected macOS host...

CVE-2026-12703

CVE-2026-12703 affects TeamViewer Full Client and Host for macOS before 15.80. A business logic error allows an authenticated attacker to bypass the configured 2FA for the Connections approval flow via Unattended Access and establish a remote connection to the macOS host. Impact: remote access wi...

WordPress security-ninja-premium plugin < 5.290 - Two-Factor Authentication Bypass vulnerability

Two-Factor Authentication Bypass vulnerability discovered by Adam Clinch in WordPress Plugin security-ninja-premium versions 5.290...

CVE-2026-63237

A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled seed to generate a matching one-time password and bypass the second authentication factor, potentially enabling unauthorised access to administrator accounts...

CVE-2026-63238

An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid user UUID without providing primary credentials via the 2FA validation endpoint...

CVE-2026-13690

The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user...

CVE-2026-63238 Authentication bypass vulnerability

An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid user UUID without providing primary credentials via the 2FA validation endpoint...

CVE-2026-63238

CVE-2026-63238 describes an authentication bypass in Koollab LMS where an unauthenticated attacker can take over any account (including administrator) by supplying a valid user UUID to the 2FA validation endpoint. The connected records reiterate this access path but do not provide version, patch,...

EUVD-2026-50133

An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid user UUID without providing primary credentials via the 2FA validation endpoint...

CVE-2026-63238

An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid user UUID without providing primary credentials via the 2FA validation endpoint...

CVE-2026-63237

A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled seed to generate a matching one-time password and bypass the second authentication factor, potentially enabling unauthorised access to administrator accounts...

EUVD-2026-50132

A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled seed to generate a matching one-time password and bypass the second authentication factor, potentially enabling unauthorised access to administrator accounts...

CVE-2026-63237

CVE-2026-63237 describes a TOTP-based two-factor authentication bypass in Koollab LMS. The vulnerability arises from allowing a client-controlled seed to generate a valid one-time password, enabling bypass of the second authentication factor and potentially unauthorized admin access. Affected pro...

CVE-2026-13690

The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user...

CVE-2026-13690

The CVE covers the UsersWP WordPress plugin before 1.2.67. The vulnerability is in the two-factor login handler where the selected authentication provider is not validated, allowing an attacker who already has valid user credentials to bypass 2FA and log in as that user. This constitutes an authe...