Vendor

devise-two-factor

1 known vulnerabilities.

Products

devise-two-factor 1

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

Medium 5.3

CVE-2024-8796

Insufficient Default OTP Shared Secret Length

Under the default configuration, Devise-Two-Factor versions >= 2.2.0 & < 6.0.0 generate TOTP shared secrets that are 120 bits instead of the 128-bit minimum defined by RFC 4226. Using a shared secret shorter than the minimum to generate a multi-factor authent…

devise-two-factor devise-two-factor devise-two-factor ruby-devise-two-factor Debian Ubuntu RubyGems

Sep 17, 2024