---
id: CVE-2026-111949
title: miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding
summary: >-
  The miniOrange 2FA  WordPress plugin before 6.3.1 does not prevent a pending
  passkey login from registering an additional passkey on an account that
  already has one configured, allowing an attacker who knows a user's password
  to add thei…
severity: none
cwe:
  - CWE-287
product: miniOrange 2FA
affected:
  - miniorange_2fa >= 6.2.9 < 6.3.1
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T06:00:22.952Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111949'
references:
  - url: 'https://wpscan.com/vulnerability/0bd43d99-6b83-4d77-85d6-2c512b8da022/'
tags:
  - cve.org
ingestedAt: '2026-10-21T06:42:48.177Z'
---

## Overview

The miniOrange 2FA  WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor.

## Affected

- `miniorange_2fa >= 6.2.9 < 6.3.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.