[ CVE-2026-111949 · Published 21 Oct 2026 ]
Vulnerability in Unknown miniOrange 2FA
CVSS 7.5
EPSS <1%No fix listed yet
[ Description ]Official description
The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.