CVE-2026-107268

Name of the Vulnerable Software and Affected Versions Two Factor Authentication - TFA / Passwordless Login versions 0.0.0 through 5.4.1 Two Factor Authentication - TFA / Passwordless Login versions 5.5.0 through 5.5.2

Description The headless login endpoint allows forceful browsing, which can lead to the disclosure of the site's stored miniOrange customer API key to unauthenticated users. This issue occurs when the Headless 2FA feature is enabled via the miniorange 2fa headless permission.

Recommendations Update Two Factor Authentication - TFA / Passwordless Login versions 0.0.0 through 5.4.1 to a version newer than 5.4.1. Update Two Factor Authentication - TFA / Passwordless Login versions 5.5.0 through 5.5.2 to a version newer than 5.5.2. Restrict the miniorange 2fa headless permission to minimize the risk of exploitation.