CVE-2026-107671: Security vulnerability
Published Oct 27, 2026
·Updated
A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification.
Event History
Oct 27, 2026
CVE Published
via MITRE·04:16 PM
Data Sourced
via MITRE·04:16 PM
DescriptionWeakness
Frequently Asked Questions
1
What level of access is required to exploit this issue?
An attacker must already have valid Administrator credentials. The available information does not indicate that unauthenticated or lower-privileged users can exploit it.
2
Is the MFA change limited to the attacker’s own account?
No. The described action disables multi-factor authentication globally before MFA verification is completed.