Chain: user is not prompted for a second authentication factor (CWE-287) when changing the case of their username (CWE-178), as exploited in the wild per CISA KEV.
CVE-2020-10148
Authentication bypass by appending specific parameters and values to a URI, as exploited in the wild per CISA KEV.
CVE-2020-0688