High · 8.6 CVE-2025-30236 EUVD-2025-6714GHSA-5p7g-3pf4-fr58

Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only a six-digit TOTP code (skipping a password check)…

Published Mar 19, 2025 · Updated Mar 19, 2025 · Assigned by mitre

Description

Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only a six-digit TOTP code (skipping a password check) if an HTTP POST request contains a SESSION parameter.

Affected products

Vendor	Product	Affected	Fixed
SecurEnvoy	SecurAccess	< 9.4.515	9.4.515

References

https://reserge.org/probabilistically-breaking-securenvoy-totp/
https://securenvoy.com/wp-content/uploads/2025/03/Release-Notes-9.4.515.pdf