CyberRota Analysis
AI-GeneratedRodauth versions prior to 2.47.0 are vulnerable to a time-based one-time password (TOTP) reuse issue, where the system does not properly track the timestamp of the last accepted code. This flaw allows attackers to replay a valid TOTP code within a specific time window, potentially bypassing the second authentication factor. Organizations using Rodauth for two-factor authentication should prioritize upgrading to mitigate the risk of unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor.