Improper Authentication in Authenticator Login Plus (2FA) - CVE-2026-126729
Published: November 12, 2026
Vulnerability identifier: #VU166047
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-126729
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to the affected module does not sufficiently enforce the second factor for authentication providers that authenticate every request on their own. A remote attacker can bypass authentication process without providing the second factor authentication.
Affected software
Authenticator Login Plus (2FA)
How to mitigate CVE-2026-126729
Install updates from vendor's website.
Authenticator Login Plus (2FA) - update to 1.0.3