Unknown miniOrange 2FA

• CVE-2026-111949 High 7.5 miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding 0.3%
• CVE-2026-77771 High 7.5 miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout 0.3%
• CVE-2026-77770 Critical 10.0 miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator 0.4%
• CVE-2026-16619 High 7.5 miniOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor Attempts 0.3%
• CVE-2026-16036 High 7.5 miniOrange 2FA < 6.2.7 - 2FA Bypass via Password-Only Second-Factor Rebinding 0.4%
• CVE-2026-16035 Medium 4.3 miniOrange 2FA < 6.2.7 - Subscriber+ Arbitrary-Recipient OTP Send 0.3%
• CVE-2026-12695 High 8.1 miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret 0.5%