← CVE Intelligence

CVE-2026-14204

Google Authenticator < 0.56 - 2FA Secret Overwrite via CSRF PUBLISHED

Description (CNA)

The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in user into overwriting their own 2FA secret with an attacker-controlled value, which enables two-factor authentication and locks the victim out of their account.

Affected (CNA)

Vendor / productVersions
Unknown / Google Authenticatoraffected 0 before 0.56

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.