Description
The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Born05 CraftCMS Plugin - Two-Factor Authentication
Default version status: unaffected
0 to ≤ 3.3.3affected
References
- https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240202-02_CraftCMS_Plugin_Two-Factor_Authentication_TOTP_Valid_After_Use ↗
- https://plugins.craftcms.com/two-factor-authentication?craft4 ↗
- https://github.com/born05/craft-twofactorauthentication/releases/tag/3.3.4 ↗
- http://www.openwall.com/lists/oss-security/2024/06/06/2 ↗