Description
mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90 seconds without detection.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| mayswind | ezBookkeeping | < 2.0.0 | 2.0.0 |
References
- GitHub Security Advisory (GHSA-p6qr-48g6-97q3) vendor-advisory
- https://github.com/mayswind/ezbookkeeping/commit/3dd6286d7a3ab0f980a6d36339b9c9c4df9467e4 patch
- ezBookkeeping v2.0.0 Release Notes release-notes
- VulnCheck Advisory: mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack third-party-advisory