{"id":"CVE-2026-111949","title":"miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding","summary":"The miniOrange 2FA  WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add thei…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"adp","cwe":["CWE-287"],"product":"miniOrange 2FA","affected":["miniorange_2fa >= 6.2.9 < 6.3.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-21T10:17:54.789364Z"},"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T10:35:03.237Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111949","references":[{"url":"https://wpscan.com/vulnerability/0bd43d99-6b83-4d77-85d6-2c512b8da022/"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T06:42:48.177Z","epss":0.00282,"epssPercentile":0.20614,"slug":"CVE-2026-111949","body":"## Overview\n\nThe miniOrange 2FA  WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor.\n\n## Affected\n\n- `miniorange_2fa >= 6.2.9 < 6.3.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":226934,"id":"CVE-2026-111949","ts":1792579639414,"field":"cvss","old":null,"new":"7.5"},{"seq":226933,"id":"CVE-2026-111949","ts":1792579639414,"field":"severity","old":"none","new":"high"}]}