Read the docs
TI-2026-78635 Aliases CVE-2026-111949GHSA-79v7-2xfm-2p77

Second-factor bypass in miniOrange 2FA via passkey rebinding

Priority LOW 35CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-287.

Summary

The miniOrange 2FA WordPress plugin from 6.2.9 before 6.3.1 does not stop a pending passkey login from registering an additional passkey on an account that already has one. An attacker who knows a user's password can add their own authenticator and bypass the second factor, as improper authentication (CWE-287) allows. The attack requires network access and low privileges, and a public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00282 20th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed miniOrange 2FA (Unknown): 6.3.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownminiOrange 2FA6.2.9 to before 6.3.16.3.1Patch availableCNA
  • miniOrange 2FA VendorUnknown Affected 6.2.9 to before 6.3.1 Fixed in 6.3.1 Patch available CNA

Remediation

Update miniOrange 2FA to version 6.3.1, which is the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA miniOrange 2FA (Unknown) Fixed in 6.3.1

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-111949
  2. 2026-10-21 Alias added: GHSA-79v7-2xfm-2p77

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences