Monthly
Account takeover is possible in phpMyFAQ before 4.1.9 and in 4.2.0-alpha before 4.2.0-beta when an attacker who already holds a valid session and matching CSRF token changes the victim's e-mail address through the user control panel without supplying the current password. The attacker can then use the password-reset flow to seize non-2FA accounts, including superadmin. This is a credible, actionable priority rather than a high-CVSS-but-low-risk issue, although the real-world footprint is modest; no public exploit has been identified at time of analysis.
Multi-factor authentication bypass in FileRise WebDAV prior to 3.16.0 allows an attacker who already holds a valid username and password for a TOTP-enabled account to authenticate to the WebDAV endpoint without supplying the second factor, then operate within that account's WebDAV file permissions. The weakness is conditionally gated: the opt-in WebDAV service must have been enabled by an administrator, the targeted account must have TOTP configured, and the attacker must already know the account's primary credentials, which the CVSS vector reflects as authenticated access (PR:L); the normal browser login path was never affected. Rated CVSS 3.1 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) with high confidentiality and integrity impact and no availability impact; no public exploit code or active exploitation was identified at time of analysis. The issue is fixed in FileRise 3.16.0.
Component-registration authentication bypass in the SAP NetWeaver Message Server allows an unauthenticated attacker with network access to register a rogue application server component into an SAP system landscape. Because the Message Server does not verify the authenticity of internal application server components during registration (CWE-308), a fraudulent component can be introduced to intercept traffic, manipulate application logic, or disrupt service, yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis; the fix is delivered through SAP Security Note 3759472 in the SAP Security Patch Day cycle.
phpMyFAQ before 4.1.8 allows an authenticated attacker who has hijacked a user's session to silently strip two-factor authentication (TOTP) protection from any account, including administrator accounts, by calling either POST /api/user/remove-twofactor or PUT /api/user/data/update with only a valid session cookie and CSRF token - no password re-entry or current TOTP code is required. The root cause is CWE-308: the application guards a security-downgrade operation with single-factor controls (session identity plus CSRF) rather than requiring the second factor whose removal is being requested. After TOTP is disabled, the targeted account becomes accessible via password-only authentication, negating the deployment's MFA posture. No public exploit code or CISA KEV listing has been identified at time of analysis.
OpenEMR through 8.2.0 exposes an OAuth2 password grant pathway that fully bypasses multi-factor authentication for any user with valid credentials, because the unauthenticated dynamic client registration endpoint allows an attacker to mint a first-party OAuth2 client and exchange legitimate credentials for an API access token without triggering the MFA challenge enforced on the normal web login interface. Any organization using OpenEMR's MFA controls to protect sensitive patient health information (PHI) is exposed: the control is structurally bypassed at the OAuth2 layer regardless of how MFA is configured in the web UI. A detailed public proof-of-concept writeup from JivaSecurity documents the full exploit flow, confirmed by VulnCheck advisory; no KEV listing has been observed at time of analysis.
Remote attackers can bypass locally configured multi-factor authentication (MFA) in Logto when users authenticate via Single Sign-On (SSO). Affecting Logto versions 1.19.0 through 1.37.1, the flaw allows an attacker with valid SSO credentials to access user accounts without providing a second factor, leading to unauthorized data access and account manipulation. No public exploit is known, and EPSS indicates low exploitation probability (0.19%).
Authentication bypass of MFA in Termix versions prior to 2.3.2 allows an attacker who already holds a victim's account password to disable TOTP or regenerate backup codes via the POST /users/totp/disable and POST /users/totp/backup-codes endpoints, completely neutralizing the second factor. The flaw stems from these MFA-critical endpoints accepting the account password as the sole authentication factor, meaning credential stuffing, phishing, or a leaked password hash (referenced as GHSA-xxxx) is sufficient to defeat 2FA. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Termix 2.4.0 through 2.5.0 permits an attacker who already holds a victim's authenticated session and knows the account password to disable TOTP two-factor authentication or regenerate (and thereby invalidate) the victim's backup codes through POST /users/totp/disable and POST /users/totp/backup-codes, degrading the account to single-factor authentication. The defect is a regression of the fix originally shipped for CVE-2026-45749: a 2.4.0 refactor made verifyTotpReauth accept a bcrypt-validated password as an interchangeable substitute for a TOTP code, so no authenticator or valid second factor is needed. Scored CVSS 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) and tracked as EUVD-2026-86120, this is a conditional security-degradation flaw rather than a high-urgency issue - the attacker cannot reach the endpoints without an active authenticated session (PR:L) and must separately know the plaintext password (driving AC:H), and the outcome is a weakened authentication posture (integrity impact only) with no confidentiality or availability impact. Vendor-released patch: 2.5.1; no public exploit code or confirmed active exploitation was identified at time of analysis.
MFA bypass in Webmin prior to 2.641 enables remote attackers holding valid credentials to circumvent multi-factor authentication entirely by supplying the literal string 'webmin' as the HTTP User-Agent header, causing the server to accept basic authentication without requiring a session cookie or a second factor. The affected CPE covers all Webmin releases before 2.641, and the impact extends well beyond the low integrity score assigned by the official CVSS - Webmin is a full server administration panel, meaning successful authentication grants control over the underlying host. No public exploit code or CISA KEV listing has been identified at time of analysis; the issue was reported by CISA-CG and patched in the 2.641 release.
### Impact If an attacker hacks into a vantage6 user's email account, they can 1) reset the password via email and then 2) reset the 2FA token via email. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity.
Account takeover is possible in phpMyFAQ before 4.1.9 and in 4.2.0-alpha before 4.2.0-beta when an attacker who already holds a valid session and matching CSRF token changes the victim's e-mail address through the user control panel without supplying the current password. The attacker can then use the password-reset flow to seize non-2FA accounts, including superadmin. This is a credible, actionable priority rather than a high-CVSS-but-low-risk issue, although the real-world footprint is modest; no public exploit has been identified at time of analysis.
Multi-factor authentication bypass in FileRise WebDAV prior to 3.16.0 allows an attacker who already holds a valid username and password for a TOTP-enabled account to authenticate to the WebDAV endpoint without supplying the second factor, then operate within that account's WebDAV file permissions. The weakness is conditionally gated: the opt-in WebDAV service must have been enabled by an administrator, the targeted account must have TOTP configured, and the attacker must already know the account's primary credentials, which the CVSS vector reflects as authenticated access (PR:L); the normal browser login path was never affected. Rated CVSS 3.1 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) with high confidentiality and integrity impact and no availability impact; no public exploit code or active exploitation was identified at time of analysis. The issue is fixed in FileRise 3.16.0.
Component-registration authentication bypass in the SAP NetWeaver Message Server allows an unauthenticated attacker with network access to register a rogue application server component into an SAP system landscape. Because the Message Server does not verify the authenticity of internal application server components during registration (CWE-308), a fraudulent component can be introduced to intercept traffic, manipulate application logic, or disrupt service, yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis; the fix is delivered through SAP Security Note 3759472 in the SAP Security Patch Day cycle.
phpMyFAQ before 4.1.8 allows an authenticated attacker who has hijacked a user's session to silently strip two-factor authentication (TOTP) protection from any account, including administrator accounts, by calling either POST /api/user/remove-twofactor or PUT /api/user/data/update with only a valid session cookie and CSRF token - no password re-entry or current TOTP code is required. The root cause is CWE-308: the application guards a security-downgrade operation with single-factor controls (session identity plus CSRF) rather than requiring the second factor whose removal is being requested. After TOTP is disabled, the targeted account becomes accessible via password-only authentication, negating the deployment's MFA posture. No public exploit code or CISA KEV listing has been identified at time of analysis.
OpenEMR through 8.2.0 exposes an OAuth2 password grant pathway that fully bypasses multi-factor authentication for any user with valid credentials, because the unauthenticated dynamic client registration endpoint allows an attacker to mint a first-party OAuth2 client and exchange legitimate credentials for an API access token without triggering the MFA challenge enforced on the normal web login interface. Any organization using OpenEMR's MFA controls to protect sensitive patient health information (PHI) is exposed: the control is structurally bypassed at the OAuth2 layer regardless of how MFA is configured in the web UI. A detailed public proof-of-concept writeup from JivaSecurity documents the full exploit flow, confirmed by VulnCheck advisory; no KEV listing has been observed at time of analysis.
Remote attackers can bypass locally configured multi-factor authentication (MFA) in Logto when users authenticate via Single Sign-On (SSO). Affecting Logto versions 1.19.0 through 1.37.1, the flaw allows an attacker with valid SSO credentials to access user accounts without providing a second factor, leading to unauthorized data access and account manipulation. No public exploit is known, and EPSS indicates low exploitation probability (0.19%).
Authentication bypass of MFA in Termix versions prior to 2.3.2 allows an attacker who already holds a victim's account password to disable TOTP or regenerate backup codes via the POST /users/totp/disable and POST /users/totp/backup-codes endpoints, completely neutralizing the second factor. The flaw stems from these MFA-critical endpoints accepting the account password as the sole authentication factor, meaning credential stuffing, phishing, or a leaked password hash (referenced as GHSA-xxxx) is sufficient to defeat 2FA. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Termix 2.4.0 through 2.5.0 permits an attacker who already holds a victim's authenticated session and knows the account password to disable TOTP two-factor authentication or regenerate (and thereby invalidate) the victim's backup codes through POST /users/totp/disable and POST /users/totp/backup-codes, degrading the account to single-factor authentication. The defect is a regression of the fix originally shipped for CVE-2026-45749: a 2.4.0 refactor made verifyTotpReauth accept a bcrypt-validated password as an interchangeable substitute for a TOTP code, so no authenticator or valid second factor is needed. Scored CVSS 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) and tracked as EUVD-2026-86120, this is a conditional security-degradation flaw rather than a high-urgency issue - the attacker cannot reach the endpoints without an active authenticated session (PR:L) and must separately know the plaintext password (driving AC:H), and the outcome is a weakened authentication posture (integrity impact only) with no confidentiality or availability impact. Vendor-released patch: 2.5.1; no public exploit code or confirmed active exploitation was identified at time of analysis.
MFA bypass in Webmin prior to 2.641 enables remote attackers holding valid credentials to circumvent multi-factor authentication entirely by supplying the literal string 'webmin' as the HTTP User-Agent header, causing the server to accept basic authentication without requiring a session cookie or a second factor. The affected CPE covers all Webmin releases before 2.641, and the impact extends well beyond the low integrity score assigned by the official CVSS - Webmin is a full server administration panel, meaning successful authentication grants control over the underlying host. No public exploit code or CISA KEV listing has been identified at time of analysis; the issue was reported by CISA-CG and patched in the 2.641 release.
### Impact If an attacker hacks into a vantage6 user's email account, they can 1) reset the password via email and then 2) reset the 2FA token via email. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity.