CVE-2026-87109 — Ops Manager Sensitive MFA Enrollment Information Exposure in User Listings
An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollmen…
Published: 2026-10-09 · CVSS: 6.0 · CVSS 4.0
An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7