Passkey Registration Bypass in miniOrange 2FA Plugin

The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The miniOrange 2FA WordPress plugin before version 6.3.1 contains an authentication bypass vulnerability that allows attackers to circumvent multi-factor authentication protections. The flaw permits registration of additional passkeys during a pending login flow, even when a passkey is already configured on the account. An attacker with knowledge of a user's password can exploit this window to add their own authenticator device, effectively neutralizing the second-factor defense that should protect against credential compromise. This affects WordPress administrators and users relying on the miniOrange plugin for 2FA security, undermining the core purpose of multi-factor authentication across potentially thousands of sites.

Casky's 283 mapped security skills leverage Claude's extended reasoning to correlate attack patterns across MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners would observe detection findings highlighting improper authentication state validation during passkey enrollment workflows—specifically, detection of passkey registration requests that should be blocked but proceed unchecked. Casky's analysis would flag the CWE-287 (Improper Authentication) root cause by identifying insufficient access controls on credential modification endpoints, revealing how attackers chain password knowledge with registration bypass to achieve persistent 2FA evasion. Security teams would see forensic indicators of unauthorized authenticator additions to accounts, suspicious passkey enrollment timing during active login attempts, and indicators suggesting attackers establishing durable post-compromise persistence through device registration.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-111949.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-111949

Casky has 283 skills that investigate the attack patterns behind CVE-2026-111949. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn