CVE-2026-77771highCWE-287

CVE-2026-77771: fallo de gravedad alta en miniOrange 2FA

miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout

Publicada el

Seguir esta CVE+ Monitorear 2FA

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

41Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 7.5epss 0.3%
de la publicación al arma2 días
Publicada en NVD10 sept
1ª PoC+2d
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a victim's password to make unlimited one-time-passcode guesses and defeat the second factor. A second validation endpoint applies no attempt limit at all.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Unknown · miniOrange 2FA
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — miniOrange 2FA

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-12695HIGHminiOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secretEPSS 0.5%CVE-2026-77770CRITICALminiOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link ValidatorEPSS 0.4%CVE-2026-16036HIGHminiOrange 2FA < 6.2.7 - 2FA Bypass via Password-Only Second-Factor RebindingEPSS 0.4%CVE-2026-16035MEDIUMminiOrange 2FA < 6.2.7 - Subscriber+ Arbitrary-Recipient OTP SendEPSS 0.3%CVE-2026-16619HIGHminiOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor AttemptsEPSS 0.3%CVE-2026-111949HIGHminiOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor RebindingEPSS 0.3%