{"id":"CVE-2026-111949","title":"miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding","summary":"The miniOrange 2FA  WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add thei…","severity":"none","cwe":["CWE-287"],"product":"miniOrange 2FA","affected":["miniorange_2fa >= 6.2.9 < 6.3.1"],"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T06:00:22.952Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111949","references":[{"url":"https://wpscan.com/vulnerability/0bd43d99-6b83-4d77-85d6-2c512b8da022/"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T06:42:48.177Z","slug":"CVE-2026-111949","body":"## Overview\n\nThe miniOrange 2FA  WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor.\n\n## Affected\n\n- `miniorange_2fa >= 6.2.9 < 6.3.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}