---
id: CVE-2026-111949
title: miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding
summary: >-
  The miniOrange 2FA  WordPress plugin before 6.3.1 does not prevent a pending
  passkey login from registering an additional passkey on an account that
  already has one configured, allowing an attacker who knows a user's password
  to add thei…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-287
product: miniOrange 2FA
affected:
  - miniorange_2fa >= 6.2.9 < 6.3.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-21T10:17:54.789364Z'
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T10:35:03.237Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111949'
references:
  - url: 'https://wpscan.com/vulnerability/0bd43d99-6b83-4d77-85d6-2c512b8da022/'
tags:
  - cve.org
ingestedAt: '2026-10-21T06:42:48.177Z'
epss: 0.00282
epssPercentile: 0.20614
---

## Overview

The miniOrange 2FA  WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor.

## Affected

- `miniorange_2fa >= 6.2.9 < 6.3.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.