https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T12:27:08.898654+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-251782 EUVD-2026-251782 2026-10-05T12:27:08.945830+00:00 EUVD-2026-251782 https://cve.radiocsirt.org/vuln/fkie_cve-2024-5657 fkie_cve-2024-5657 2026-10-05T12:27:08.945871+00:00

The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.

 https://cve.radiocsirt.org/vuln/ghsa-3p4x-grpm-xw58 GHSA-3p4x-grpm-xw58 — Password hash exposed in CraftCMS two factor authentication plugin 2026-10-05T12:27:08.945904+00:00

Affected: Packagist: born05/craft-twofactorauthentication

The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.