Quick answers
- Is CVE-2026-77771 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-77771 being exploited in the wild.
- How severe is CVE-2026-77771?
- High severity, with a CVSS score of 7.5, published 10 September 2026.
- Which products and versions are affected?
- miniOrange 2FA before 6.3.1, before 19.3.
- Is there a fix for CVE-2026-77771?
- A patch was published on 2026-09-10: Versions 6.3.1 and 19.3 available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-77771 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-77771?
- Check whether you run miniOrange 2FA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an authentication bypass (CWE-287) in the OTP validation logic. The plugin keys its second-factor attempt limit to a client-controllable identifier instead of the target account, allowing an attacker to change the identifier at will and reset the attempt counter. Additionally, a second validation endpoint applies no rate limiting whatsoever. The attack requires prior knowledge of the victim's password but needs no authentication or user interaction beyond submitting OTP guesses. An attacker can perform a brute-force attack against the OTP space to compromise any account protected by this plugin's 2FA. Patches are available in versions 6.3.1 and 19.3.
Affected products
- miniOrange 2FA before 6.3.1, before 19.3
Timeline
- 2026-09-08: disclosed
- 2026-09-10: advisory
- 2026-09-10: patched: Versions 6.3.1 and 19.3 available