WordPress Plugin Vulnerabilities
miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding
Description
The plugin does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor.
Proof of Concept
Affects Plugins
Fixed in 6.3.1 References
CVE
Classification
Type
AUTHBYPASS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
RIA Labs
Submitter
RIA Labs
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-10-19 (about 1 day ago)
Added
2026-10-19 (about 13 hours ago)
Last Updated
2026-10-19 (about 13 hours ago)
