Description Insufficient state checks lead to a vector that allows to bypass 2FA checks. Remediation References CVE-2026-48896 Related Vulnerabilities WordPress 'xmlrpc.php' Remote Security Bypass Vulnerability (3.0.1 - 3.0.2) MySQL CVE-2016-0596 Vulnerability (CVE-2016-0596) WordPress Plugin Events Manager Multiple Vulnerabilities (5.9.7.3) Craft CMS Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2023-30130) Oracle Application Server Observable Differences in Behavior to Error Inputs Vulnerability (CVE-2018-5407) Severity High Classification CVE-2026-48896 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Tags Missing Update Known Vulnerabilities