PULSE
EN
FEED
ransomn0n reclama a Company #103 · PT · Not Foundransomn0n reclama a Company #102 · Not Foundransomn0n reclama a Company #101 · Not Foundransomn0n reclama a Company #100 · Not Foundransomn0n reclama a Company #99 · Not Foundransomn0n reclama a TheHomeMag NorCal · US · Retail & E-Commerceransomclop reclama a LEGAL-RECORDS.US · US · Professional Servicesransomscarlettgroup reclama a nbcuniversal.com · US · Technologyransomn0n reclama a Xylanpicks · US · Not Foundransombravox reclama a GSE-M Technology Sdn. Bhd. · MY · Technologyransomemperador reclama a Bruin Group LLC · US · Otherransomsilentransomgroup reclama a M... M... · Not Foundransomsilentransomgroup reclama a P... H... · Not Foundransomglobal secret group reclama a Graves Fireplaces, Inc. · US · Manufacturingransomn0n reclama a Company #103 · PT · Not Foundransomn0n reclama a Company #102 · Not Foundransomn0n reclama a Company #101 · Not Foundransomn0n reclama a Company #100 · Not Foundransomn0n reclama a Company #99 · Not Foundransomn0n reclama a TheHomeMag NorCal · US · Retail & E-Commerceransomclop reclama a LEGAL-RECORDS.US · US · Professional Servicesransomscarlettgroup reclama a nbcuniversal.com · US · Technologyransomn0n reclama a Xylanpicks · US · Not Foundransombravox reclama a GSE-M Technology Sdn. Bhd. · MY · Technologyransomemperador reclama a Bruin Group LLC · US · Otherransomsilentransomgroup reclama a M... M... · Not Foundransomsilentransomgroup reclama a P... H... · Not Foundransomglobal secret group reclama a Graves Fireplaces, Inc. · US · Manufacturing
← Todos los CVEs
CVE Watch21 oct 2026

CVE-2026-111949

The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an acco

CVSS

—

Sin CVSS

EPSS

—

KEV

—

Exploit Today

0

0-100

Publicado: 21 oct 2026 · Última mod.: 21 oct 2026

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor.

Referencias oficiales
CVEs relacionados

Sin CVEs relacionados por CWE o producto.