What’s Vulnerable › Products

miniOrange 2FA vulnerabilities

7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your miniOrange 2FA version is affected

Latest miniOrange 2FA vulnerabilities

• CVE-2026-111949 — miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding (CVSS 7.5)
• CVE-2026-77771 — miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout (CVSS 7.5)
• CVE-2026-77770 — miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator (CVSS 10.0)
• CVE-2026-16619 — miniOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor Attempts (CVSS 7.5)
• CVE-2026-16036 — miniOrange 2FA < 6.2.7 - 2FA Bypass via Password-Only Second-Factor Rebinding (CVSS 7.5)
• CVE-2026-16035 — miniOrange 2FA < 6.2.7 - Subscriber+ Arbitrary-Recipient OTP Send (CVSS 4.3)
• CVE-2026-12695 — miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret (CVSS 8.1)