CSRF Vulnerability in Google Authenticator Plugin Allows 2FA Secret Overwrite (CVE-2026-14204)

Vulnerability Overview Vulnerability Name: Google Authenticator < 0.56 - 2FA Secret Overwrite via CSRF Description: This plugin fails to validate the CSRF token when saving its two-factor authentication settings, allowing an attacker to trick a logged-in user into overwriting their own 2FA secret key, thereby locking the victim out of their account. CVE ID: CVE-2026-14204 Type: CSRF OWASP Top 10: A2: Broken Authentication and Session Management CWE: CWE-352 CVSS Score: 5.4 (medium) Affected Range Affected Plugin: google-authenticator Fixed Version: 0.56 Remediation Fixed Version: Upgrade to version 0.56 or higher. Timeline Public Disclosure Date: 2026-08-03 Added Date: 2026-08-03 Last Updated Date: 2026-08-03 Additional Information Original Researcher: Miguel Mendez Z Submitter: Miguel Mendez Z Submitter Website: https://stkr10s.github.io Verification Status: Yes WPVDB ID: 9ae793b2-31d4-4a9d-9481-52f07024b07e References CVE: CVE-2026-14204 Other Related Vulnerabilities Snap Pixel < 1.6.0 - Arbitrary Settings Update via CSRF MultiMailer <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting Tabs <= 4.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting GDPR Cookie Compliance < 4.12.5 - License Update/Deactivation via CSRF Social Bookmarking RELOADED <= 3.18 - Cross-Site Request Forgery to Stored Cross-Site Scripting POC Code POC Code: The page states that the POC will be revealed on August 17, 2026, to allow users time to update.

Goal Reached Thanks to every supporter — we hit 100%!

CSRF Vulnerability in Google Authenticator Plugin Allows 2FA Secret Overwrite (CVE-2026-14204)

More from this source