Mohammed Hisam

#19126of 60,402
16.2Total CVSS
Vulnerabilities · 3
Medium
3
PT-2026-107759
2026-10-07
4.3
CVE-2026-107268
Drupal
Two Factor Authentication - Tfa / Passwordless Login
The headless login endpoint allows forceful browsing, which can lead to the disclosure of the site's stored miniOrange customer API key to unauthenticated users. This issue occurs when the Headless 2FA feature is enabled via the `miniorange 2fa headless` permission.
PT-2026-84898
2026-09-02
6.5
CVE-2026-84923
Drupal
Email Verification / Sms Verification / Otp Verification
An authentication bypass issue exists due to insufficient validation of user-supplied input. This flaw allows an attacker to bypass the verification process during user registration, potentially leading to account takeover.
PT-2026-84899
2026-09-02
5.4
CVE-2026-84924
Drupal
Email Verification / Sms Verification / Otp Verification
An unauthenticated reflected Cross-site Scripting (XSS) issue exists because the module does not sufficiently filter user-supplied input before outputting it during web page generation.