CVE-2026-111949: miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding
The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
miniOrange 2FA WordPress pluginto a version that resolves this vulnerability.Fixed in 6.3.1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must know the target user's password and be able to begin a passkey login flow. They can then register an additional passkey for an account that already has a passkey configured.
Which plugin versions are affected?
miniOrange 2FA versions before 6.3.1 are affected. Versions 6.2.9 through 6.3.0 are explicitly identified.
What is the practical impact of successful exploitation?
An attacker can bind their own authenticator to the victim's account and use it to bypass the account's second-factor protection.