tinfoilsecurity devise-two-factor vulnerabilities

Latest tinfoilsecurity devise-two-factor CVEs

Newest publication first

1. CVE-2024-8796 Insufficient Default OTP Shared Secret Length

   Published 2024-09-17

   Medium·CVSS 6.0 EPSS 0.64%

   Under the default configuration, Devise-Two-Factor versions >= 2.2.0 & < 6.0.0 generate TOTP shared secrets that are 120 bits instead of the 128-bit minimum defined by RFC 4226. Using a shared secret shorter than the minimum to generate a multi-factor authentication code could ma...

2. CVE-2021-43177 Improper one time password handling in devise-two-factor

   Published 2022-04-11

   Medium·CVSS 5.3 EPSS 0.88% PoC

   As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)

3. CVE-2015-7225 Tinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP)

   Published 2017-09-06

   Medium·CVSS 5.3 EPSS 2.1% PoC

   Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.