CVE-2026-126571

Padloc 4.0.0 before 4.3.1 contains an authentication bypass vulnerability in the legacy retrieveMFAToken handler that never counts wrong email verification codes toward the attempt limit. Unauthenticated attackers knowing a victim's email can brute force the 6-digit code to obtain verification...

CVE-2026-112775

Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the...

EUVD-2026-104581

Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the...

PT-2026-117626

Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the...

Apache Answer authorization issue vulnerability

Versions 2.0.2 and earlier of Apache Answer contain an authorization issue vulnerability. This vulnerability stems from improper validation of verification code usage, allowing verification codes issued for one email workflow to be accepted by another sensitive workflow...

CVE-2026-111675 Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover

Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can...

EUVD-2026-102966

Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can...

CVE-2026-111675

The Course-tencent-cloud application (through version 2.0.1 ) is vulnerable to an improper restriction of authentication attempts (CWE-307). The vulnerability allows unauthenticated attackers to brute force 6-digit SMS or email verification codes because these codes are never invalidated or limit...

CVE-2026-111675 Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover

Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can...

CVE-2026-111675: Improper Restriction of Excessive Authentication Attempts

Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can...

Jacky Huang – Tencent Cloud Authorization Issue Vulnerability

The Tencent Cloud courses for versions 2.0.1 and earlier have an authorization issue vulnerability. This vulnerability stems from improper restrictions on authentication attempts. No expiration time or attempt limit is set for the 6-digit SMS/email verification codes. This allows unauthorized...

CVE-2026-49265

A flaw was found in oauthlib. A timing side-channel vulnerability in the Proof Key for Code Exchange PKCE validation process allows a remote attacker to recover secret verification codes. Because comparison operations do not execute in constant time, an attacker who has intercepted an authorizati...

CVE-2026-97063

The X-SpringBoot framework, versions through 6.0 , is vulnerable to an authentication bypass due to the exposure of login verification codes. The application returns these codes directly in HTTP responses from unauthenticated endpoints, specifically GET /sys/mobile/code and GET /sys/email/code , ...

PT-2026-99092

Name of the Vulnerable Software and Affected Versions X-SpringBoot versions prior to 6.0 Description Unauthenticated endpoints return login verification codes directly in HTTP responses without sending them to the account owners. An attacker can request these codes using a known mobile number or...

CVE-2026-97063: Improper Authentication

X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes using known mobile numbers or email addresses, read them from responses, and...

CVE-2026-18469

The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data, allowing unauthenticated attackers to reset the limit at will...

Improper Authorization

github.com/zitadel/zitadel is vulnerable to Improper Authorization. The vulnerability is due to missing permission checks in the email and phone self-management API endpoints, which allows an attacker to request verification codes for email addresses or phone numbers they do not control, claim...

CVE-2026-14836 Login/Signup Popup < 3.2.5 - Unauthenticated Account Takeover via Password Reset Rate Limit Bypass

The Login & Register Forms WordPress plugin before 3.2.5 does not properly enforce the rate limit on its password-reset verification-code flow, keying both the verification code and the per-source attempt counter on an unauthenticated, client-controlled value, allowing unauthenticated attackers t...

CVE-2026-54693

ZITADEL is an open source identity management platform. From 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, and from 4.0.0 until 4.15.1, the email and phone self-management API paths in internal/command/userv2email.go, internal/command/userv2phone.go, and internal/command/userv2human.go allowed...

CVE-2026-54693

ZITADEL is an open source identity management platform. From 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, and from 4.0.0 until 4.15.1, the email and phone self-management API paths in internal/command/userv2email.go, internal/command/userv2phone.go, and internal/command/userv2human.go allowed...