#Account Takeover
All CosmicBytez Labs articles tagged #Account Takeover, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-105209: ZITADEL Cross-Organization Account Takeover via Passkey Enrollment
ZITADEL checks only the caller's org header, not the target user's org, letting low-privileged admins enroll passkeys on other orgs' accounts.
- Security
CVE-2026-105207: ZITADEL Unauthenticated Account Takeover via Unverified IdP Linking
ZITADEL links accounts to external identity providers without verifying a primary factor, letting attackers sign in as any known user.
- News
Crypto Scammers Hijack Microsoft's Official X Account
Hackers briefly took over Microsoft's 13-million-follower X account to push a fake $Clippy crypto token before the company regained control.
- News
Microsoft's X Account Hacked in Crypto Pump-and-Dump Scheme
Hackers hijacked Microsoft's 13M-follower X account on Oct. 1 to push a fake $Clippy token tied to $MSFT before Microsoft regained control.
- Security
Critical Auth Bypass in DevKit Pro Lets Unauthenticated Attackers Take Over WordPress Admin Accounts
Critical CVSS 9.8 auth bypass in DevKit Pro (≤2.3.0) lets unauthenticated attackers forge a cookie and take over any WordPress administrator account.
- Security
Critical Auth Bypass in Divi Membership Lets Attackers Log In as Any User
CVE-2026-19660 (CVSS 9.8): a forged paypal_param GET request lets unauthenticated attackers log in as any WordPress user, including admins.
- Security
CVE-2026-85984: miniOrange OTP Login Plugin Authentication Bypass
Unauthenticated attackers can log in as any WordPress admin via a missing password check in miniOrange OTP Login ≤ 5.5.5 (CVSS 9.8).
- Security
CVE-2026-5430: WSO2 Multiple Products Path Traversal Vulnerability
CISA added CVE-2026-5430 to its KEV catalog after active exploitation of a critical, unauthenticated WSO2 API management flaw.
- Security
CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability
CVE-2026-71362 (CVSS 9.1) lets unauthenticated attackers hijack Adobe Commerce and Magento customer sessions; CISA added it to KEV after active exploitation.
- Security
SAML Single Sign On Plugin Flaw Enables WordPress Account Takeover
CVE-2026-82842 lets a malicious identity provider assert any login name, letting attackers authenticate as any WordPress user, including admins.
- Security
CVE-2026-54460: OpenReception Unauthenticated Passkey Injection
A missing auth check on OpenReception's passkey endpoint lets unauthenticated attackers inject WebAuthn credentials and take over staff accounts.
- Security
CVE-2026-63472: Vendure External-Authentication Account Takeover
A CVSS 9.1 flaw lets attackers bind their external login to a victim's Vendure account by email match alone, enabling full account takeover.
- News
Telus Warns Customers of Account Breaches
Telus says stolen credentials were used over 16 months to access customer accounts and billing data; scope of impact undisclosed.
- Security
Critical Auth Bypass in Frontend Admin Plugin Enables Full Account Takeover
A critical flaw in the Frontend Admin by DynamiApps WordPress plugin lets unauthenticated attackers hijack any account, including admins.
- Security
CVE-2026-16310: MemberDash WordPress Plugin Unauthenticated Account Takeover
MemberDash ≤ 1.8.5 has an IDOR letting unauthenticated attackers change any WordPress user's password via a crafted registration request.
- News
UK Account-Hack Losses Surge Fivefold — But New Reporting System Is the Real Story
City of London Police reports a £6.3M jump in UK account-hacking losses, but says most of the rise reflects better reporting, not more attacks.
- News
Dropbox Accounts Breached Through Lenovo Email Verification Flaw
A flaw in Lenovo's email verification let attackers register fake Lenovo IDs and silently access ~5,000 Dropbox accounts via SSO.
- Security
CVE-2026-18550: Nokri WordPress Theme Unauthenticated Account Takeover
A critical unauthenticated account-takeover flaw in the Nokri WordPress job board theme lets attackers reset any user's password, including admins.
- Security
MyHome Core WordPress Plugin: Auth Bypass Enables Admin Takeover (CVE-2026-15980)
CVE-2026-15980 (CVSS 9.8) lets unauthenticated attackers forge activation tokens to hijack WordPress accounts via MyHome Core.
- News
Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE
Five critical flaws in WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP enable auth bypass, takeover, and RCE.
- Security
Uix UserCenter WordPress Plugin: Hardcoded Signing Key Enables Unauthenticated Account Takeover
CVE-2026-16259 (CVSS 9.8) lets attackers hijack any account on sites running Uix UserCenter — no login needed, and no fix exists yet.
- Security
Critical TranslatePress Flaw Exposes 400,000+ WordPress Sites to Account Takeover
CVE-2026-19632 leaks a plaintext admin password-reset key via an unauthenticated AJAX action in TranslatePress, enabling full site takeover.
- News
Critical Keycloak Flaw Lets Attackers Reset Any Account Password Without Authentication
CVE-2026-18963 (CVSS 9.1) in Keycloak allows unauthenticated attackers to bypass email verification and take over any account. Patch to 26.7.2 immediately.
- Security
CVE-2026-16142: TrueBooker WordPress Plugin Unauthenticated Account Takeover
A CVSS 9.8 flaw in TrueBooker for WordPress allows unauthenticated attackers to take over any user account via a vulnerable AJAX handler.
- Security
CVE-2026-15341: WordPress User Session Synchronizer — Account Takeover
Critical auth bypass in User Session Synchronizer plugin v1.4.0 lets unauthenticated attackers hijack any WordPress account via session sync on every request.
- Security
CVE-2026-12949: Critical Account Takeover in WordPress Wishlist Member Plugin
Critical CVSS 9.8 flaw in WordPress Wishlist Member plugin allows unauthenticated account takeover in versions up to 3.34.1.
- News
FBI: Hackers Using Social Engineering to Breach Accounts and Steal Explicit Content
The FBI warns hackers are breaching social media accounts to steal explicit content via credential stuffing, impersonation, and fake clone sites.
- Security
CVE-2026-14182: WooCommerce Email Verification Bypass Allows Account Takeover
A CVSS 9.8 type juggling flaw in Customer Email Verification for WooCommerce lets unauthenticated attackers take over any customer account.
- News
Hackers Exploit Critical Adobe Commerce Flaw to Hijack Customer Accounts
Active exploitation of CVE-2026-71362 in Adobe Commerce and Magento is underway, with attackers targeting customer account takeover on e-commerce storefronts.
- Security
CVE-2026-14364: TrueBooker WordPress Plugin Account Takeover via Password Reset Bypass
A critical unauthenticated account takeover vulnerability in the TrueBooker Appointment Booking plugin for WordPress allows attackers to reset any user's...
- Security
CVE-2026-14365: TrueBooker WordPress Plugin Authorization Bypass Enables Unauthenticated Password Change
A second critical flaw in the TrueBooker Appointment Booking WordPress plugin allows unauthenticated attackers to change the password of any user,...
- Security
CVE-2026-41452: Krayin CRM Admin Account Takeover via Installer Middleware Bypass
A critical missing authentication vulnerability in Krayin CRM 2.2.4 allows unauthenticated attackers to overwrite the primary administrator account by...
- Security
CVE-2026-18577: N-able N-central Authentication Bypass and Account Takeover
N-able N-central contains an authentication bypass via alternate path vulnerability enabling full account takeover, added to CISA KEV as an incomplete...
- Security
CVE-2026-14545: TrueBooker WordPress Plugin Lets Anyone Take Over Admin Accounts
An unauthenticated password reset flaw in TrueBooker (before v1.2.4) lets any attacker set an arbitrary password on any WordPress account — including...
- News
CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking
New research from CTM360 shows that phishing campaigns targeting insurance and financial portals have moved beyond simple credential harvesting. Attackers...
- News
Chick-fil-A Discloses Data Breach After Credential Stuffing Attacks
Chick-fil-A is notifying customers across 10 states after credential stuffing attacks between June 17–19, 2026 compromised One loyalty accounts, exposing...
- News
Zoom Warns of Critical Account Takeover Vulnerability (CVE-2026-53412, CVSS 9.8)
Zoom has disclosed a critical improper input validation flaw in its Windows desktop client and SDK that allows unauthenticated network attackers to hijack...
- News
Hackers Hijack Russian Journalist Sobchak's Telegram Channels via Email Breach, Claim 350 GB Stolen
Hacker group Black Mirror compromised Ksenia Sobchak's email account and used it to seize two of her Telegram channels with 1.5 million combined...
- Security
CVE-2026-12761: miniOrange WordPress Social Login Auth Bypass Enables Full Admin Takeover
A critical authentication bypass chain in the miniOrange Social Login and Register WordPress plugin allows unauthenticated attackers to crack a trivially...
- Security
CVE-2026-55879: OpenReplay Stored XSS Enables Dashboard Account Takeover
A critical stored XSS vulnerability in OpenReplay's session replay SDK allows unauthenticated attackers to inject malicious scripts via the public...
- Security
CVE-2026-9701: WordPress Eventer Plugin — Insecure Password Reset Enables Account Takeover
A critical CVSS 9.8 vulnerability in the Eventer WordPress plugin exposes plaintext password reset keys in user meta, allowing unauthenticated attackers...
- Security
CVE-2026-12073: ProfileGrid WordPress Plugin Critical Privilege Escalation
A critical CVSS 9.8 vulnerability in the ProfileGrid WordPress plugin allows unauthenticated attackers to take over any user account and escalate...
- Security
CVE-2026-12415: WordPress Invoice Generator Privilege Escalation (CVSS 9.8)
A critical unauthenticated privilege escalation flaw in the WordPress Invoice Generator plugin allows any attacker to take over administrator accounts via...
- Security
CVE-2026-45688: Rocket.Chat CAS Login MongoDB Operator Injection (CVSS 9.1)
Critical unauthenticated account takeover vulnerability in Rocket.Chat's CAS login handler passes unsanitized client input directly into a MongoDB findOne...
- Security
CVE-2026-11374: ManageEngine SSO Ticket Prediction Enables Unauthenticated Account Takeover
A critical authentication vulnerability in four ManageEngine products allows unauthenticated attackers to predict SSO session tickets and take over...
- Security
CVE-2026-9851: WordPress Booking Package Plugin Privilege Escalation via Account Takeover
A high-severity privilege escalation vulnerability in the Booking Package WordPress plugin allows unauthenticated or low-privileged attackers to take over…
- Security
CVE-2026-8206: Kirki WordPress Plugin Critical Privilege Escalation via Account Takeover
The Kirki Freeform Page Builder plugin for WordPress (versions 6.0.0–6.0.6) allows unauthenticated attackers to take over any user account during password…
- News
Hackers Used Meta's AI Support Bot to Seize Instagram Accounts
Iran-linked hackers exploited Meta's AI support assistant to reset account credentials, briefly defacing the Instagram accounts of the Obama White House and…
- Security
CVE-2026-7459: WordPress Simple History Plugin Account Takeover
A broken authentication check in the Simple History WordPress plugin (versions up to 5.26.0) allows Subscriber-level users to take over any WordPress...
- Security
CVE-2026-35676: phpMyFAQ Unauthenticated Password Reset Vulnerability
phpMyFAQ before 4.1.3 contains a CVSS 8.2 flaw allowing unauthenticated attackers to reset any account password without token validation, enabling full...
- Security
CVE-2026-3655: OTP Login WordPress Plugin Auth Bypass via Firebase Session Mismatch
A critical authentication bypass (CVSS 9.8) in the OTP Login With Phone Number WordPress plugin allows unauthenticated attackers to log in as any user due...
- Security
CVE-2026-8732: WP Maps Pro Privilege Escalation via Admin Account Creation
A critical unauthenticated privilege escalation flaw in WP Maps Pro for WordPress (CVSS 9.8) allows attackers to create administrator accounts without...
- News
Why Chargebacks Are Just One Piece of the Fraud Puzzle
Fraud losses don't stop at chargebacks. False declines, account takeovers, and promotional abuse also silently erode revenue and customer trust — yet many...
- Security
CVE-2026-34909 — UniFi OS Path Traversal Leading to Account
A CVSS 10.0 path traversal vulnerability in UniFi OS allows an unauthenticated network attacker to read arbitrary files, including sensitive account files...
- Security
WordPress Form Notify Plugin Auth Bypass via LINE OAuth
The Form Notify plugin for WordPress is vulnerable to authentication bypass in versions up to and including 1.1.10. Attackers can manipulate...
- Security
Critical Session Hijacking via Auth Bypass in Akilli
CVE-2026-2347 is a CVSS 9.8 authorization bypass in Akilli's e-commerce platform, allowing attackers to hijack authenticated sessions by manipulating...
- Security
CVE-2021-47923: OpenCart 3.0.3.8 Session Fixation Enables
OpenCart 3.0.3.8 fails to regenerate the OCSESSID session cookie after authentication, allowing attackers to inject a known session ID and hijack any user...
- Security
CVE-2026-7458: Authentication Bypass via OTP Flaw in WordPress User Verification Plugin
A critical authentication bypass in the User Verification by PickPlugins plugin for WordPress allows unauthenticated attackers to bypass OTP verification...
- Security
CVE-2026-24467: OpenAEV Password Reset Account Takeover
OpenAEV's password reset implementation contains multiple chained weaknesses enabling reliable account takeover in versions 1.0.0 through 2.0.12 of the...
- News
Device Code Phishing Attacks Surge 37x as New Kits Spread
Device code phishing attacks abusing the OAuth 2.0 Device Authorization Grant flow have exploded 37-fold in 2026 as ready-made phishing kits proliferate...
- Security
Critical Auth Bypass in Tutor LMS Pro Exposes 30,000+
The Tutor LMS Pro WordPress plugin's Social Login addon fails to verify OAuth token email matches the login request, allowing unauthenticated attackers to...
- Security
CVE-2026-29067: ZITADEL Password Reset Poisoned by Host Header Injection
A high-severity host header injection vulnerability in ZITADEL's login V2 password reset flow allows attackers to redirect reset links to...
- Security
ZITADEL Critical XSS in SAML Endpoint Enables 1-Click
A critical cross-site scripting vulnerability in ZITADEL's login V2 /saml-post endpoint allows unauthenticated attackers to execute arbitrary JavaScript...
- Security
CVE-2026-29192: ZITADEL Stored XSS via Default Redirect URI
A stored cross-site scripting vulnerability in ZITADEL's login V2 interface allows organization administrators to inject malicious JavaScript via a...