PatchTheCVEminiorange 2fa vulnerabilities and fixes
Recent CVEs affecting miniorange 2fa, with upgrade or downgrade steps. 6 tracked.
Also searched as: miniorange2fa.
miniorange 2fa has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 6. Most recent: 2025-06-26. Highest priority: CVE-2025-47707 (score 40/100).
- CVE-2025-6675 MEDIUM 4.8 UPGRADE Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drup
- CVE-2025-47710 HIGH 7.4 UPGRADE Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drup
- CVE-2025-47709 MEDIUM 6.5 UPGRADE Missing Authorization vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Forceful Browsing.This is
- CVE-2025-47708 HIGH 8.8 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Cross Site Re
- CVE-2025-47707 HIGH 7.5 UPGRADE Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drup
- CVE-2025-47706 MEDIUM 4.8 UPGRADE Authentication Bypass by Capture-replay vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Remote
FAQ
How do I fix miniorange 2fa vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is miniorange 2fa being exploited right now?
None of the tracked miniorange 2fa CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which miniorange 2fa CVE should I patch first?
CVE-2025-47707 currently ranks highest (40/100): Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drup.