two_factor_authentication vulnerabilities

CVEs whose affected-version data names the two_factor_authentication package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-111739High· 7.5

1w ago

Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' Parameter

The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker wh…

▾ TwilightEPSS 0.29%via CVEORG