Advisories · Technology
miniOrange 2FA.
Every CVE that names miniOrange 2FA among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.5 High
miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding
- miniOrange 2FA
- Authentication bypass
- CVSS 7.5 High
miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout
- miniOrange 2FA
- Authentication bypass
- CVSS 10.0 CriticalCritical · CVSS 9+
miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator
- miniOrange 2FA
- Broken access control
- CVSS 7.5 High
miniOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor Attempts
- miniOrange 2FA
- Authentication bypass
- CVSS 7.5 High
miniOrange 2FA < 6.2.7 - 2FA Bypass via Password-Only Second-Factor Rebinding
- miniOrange 2FA
- Authentication bypass
- CVSS 4.3 Medium
miniOrange 2FA < 6.2.7 - Subscriber+ Arbitrary-Recipient OTP Send
- miniOrange 2FA
- Broken access control
- CVSS 8.1 High
miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret
- miniOrange 2FA
- Authentication bypass