https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-11T11:56:39.264812+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-118202 CVE-2026-118202 — Limit Login Attempts Reloaded < 3.4.1 - Two-Factor Authentication Bypass via Malformed X-Forwarded-For Header 2026-11-11T11:56:39.265492+00:00

Affected: Unknown Limit Login Attempts Security

The Limit Login Attempts Security WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before completing a login and treats a failure to build that step as success, so an attacker who holds a protected user's password can bypass the second factor by sending a request header that breaks the step.