GO-2026-6057 Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface in code.gitea.io/gitea

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth X-Gitea-OTP surface in code.gitea.io/gitea...

First-Person Identity Theft Story

Harrowing story of an identity theft victim. Yes, the person made a mistake--they gave the scammer a two-factor authentication code that allowed the scammer to take over their email address. But the real story here is how, for many of us, the security of most of our accounts hangs on the security...

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

Summary I'm reporting two related TOTP one-time-use defects in Gitea that survive the CVE-2021-45331 fix. The 2018 fix PR 3878 introduced the TwoFactor.LastUsedPasscode field and added an in-memory inequality check on the web 2FA login path. That check works correctly in the single-request case,...

EUVD-2026-41613

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth X-Gitea-OTP surface...

GHSA-GX3V-Q759-G323 Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

Summary I'm reporting two related TOTP one-time-use defects in Gitea that survive the CVE-2021-45331 fix. The 2018 fix PR 3878 introduced the TwoFactor.LastUsedPasscode field and added an in-memory inequality check on the web 2FA login path. That check works correctly in the single-request case,...

CVE-2025-68640

The Apple Find My backend service through 2025-12-17 allows an attacker in possession of a valid PET Private Endpoint Token to enumerate devices and remove offline devices from an Apple ID account without triggering two-factor authentication or ownership verification. This may result in...

Examining User Behavior and Cognitive Biases in Personal Password Security

Despite increasing awareness of cybersecurity risks, users continue to engage in insecure password practices, such as reusing passwords, choosing weak credentials, and neglecting security recommendations. The study explores the behavioral and cognitive factors that influence password...

CVE-2025-68640

The Apple Find My backend service through 2025-12-17 allows an attacker in possession of a valid PET Private Endpoint Token to enumerate devices and remove offline devices from an Apple ID account without triggering two-factor authentication or ownership verification. This may result in...

CVE-2025-68640

The Apple Find My backend service through 2025-12-17 allows an attacker in possession of a valid PET Private Endpoint Token to enumerate devices and remove offline devices from an Apple ID account without triggering two-factor authentication or ownership verification. This may result in...

CVE-2026-42210

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor typically TOTP, an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication...

CVE-2026-42210 Webmin 2FA requirement bypass

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor typically TOTP, an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication...

CVE-2026-42210

Webmin prior to 2.640 contains a 2FA bypass where an attacker who knows a valid Webmin username and password can bypass the second authentication factor by authenticating with Basic authentication. The issue is documented with a CVSS 4.0 vector and a base score of 5.3 (MEDIUM). The recommended re...

CVE-2026-42210

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor typically TOTP, an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication...

EUVD-2026-46035

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor typically TOTP, an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication...

CVE-2026-42210 Webmin 2FA requirement bypass

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor typically TOTP, an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication...

CVE-2026-42210 Webmin 2FA requirement bypass

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor typically TOTP, an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication...

PT-2026-61652

Name of the Vulnerable Software and Affected Versions Webmin versions prior to 2.640 Description Webmin is a web-based system administration tool for Unix-like servers. An attacker who possesses a valid username and password can bypass the two-factor authentication 2FA requirement, such as...

Authentication Bypass

Kimai is vulnerable to Authentication Bypass. The vulnerability is due to the REST API accepting the KIMAISESSION cookie as authenticated before TOTP verification is completed, which allows an attacker with a valid account password to bypass two-factor authentication and access protected API...

Authentication Bypass

Froxlor is vulnerable to Authentication Bypass. The vulnerability is due to the two-factor validation endpoint issuing a full authenticated session without verifying the user's password, CSRF token, or rate limits, which allows an attacker to brute-force valid TOTP codes and obtain an authenticat...

FreeBSD : phpmyfaq -- multiple vulnerabilities (0a0aca9f-8290-11f1-a93b-50ebf6bdf8e9)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0a0aca9f-8290-11f1-a93b-50ebf6bdf8e9 advisory. phpMyFAQ team reports: An authenticated administrator can supply an untrusted update-package path to th...