CVE-2026-94112

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90...

CVE-2026-94112 mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90...

EUVD-2026-83734

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90...

CVE-2026-94112 mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90...

CVE-2026-94112

mayswind ezBookkeeping versions before 2.0.0 contain a TOTP replay attack vulnerability: the application fails to invalidate one-time passcodes after use. An attacker with stolen credentials can replay a captured TOTP code against multiple authorization attempts within the ~90-second acceptance w...

CVE-2026-94112 mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90...

PT-2026-95968

Name of the Vulnerable Software and Affected Versions mayswind ezBookkeeping versions prior to 2.0.0 Description The software fails to invalidate Time-based One-Time Password TOTP passcodes after they have been used. This allows an attacker who has obtained stolen credentials to replay a captured...

CVE-2026-94112: Authentication Bypass by Capture-replay

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90...

CLEANSTART-2026-PZ14685 Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused

Security vulnerability affects the vault package. Vault and Vault Enterprise’s “Vault” login MFA rate limits could be bypassed and TOTP tokens could be reused...

CLEANSTART-2026-RG79000 Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period

Security vulnerability affects the vault package. Vault and Vault Enterprise’s “Vault” TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period...

Duplicate Advisory: Vikunja: TOTP secret is readable after enrollment, no step-up auth

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-88f6-4rjv-x774. This link is maintained to preserve external references. Original Description Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET...

CVE-2026-91982

Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a valid access token can read the secret, import it into their own authenticato...

CVE-2026-91982 Vikunja before 2.6.0 TOTP Secret Disclosure via API

Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a valid access token can read the secret, import it into their own authenticato...

CVE-2026-91982

Vikunja before 2.6.0 exposes the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /qrcode endpoints without requiring re-authentication. An attacker holding a valid access token can read the secret, import it into their own authenticator app, and generate val...

CVE-2026-91982 Vikunja before 2.6.0 TOTP Secret Disclosure via API

Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a valid access token can read the secret, import it into their own authenticato...

CVE-2026-91982 Vikunja before 2.6.0 TOTP Secret Disclosure via API

Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a valid access token can read the secret, import it into their own authenticato...

CVE-2026-91982

Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a valid access token can read the secret, import it into their own authenticato...

CVE-2026-52827

Kimai is an open-source time tracking application. Prior to 2.59.0, the KIMAISESSION cookie issued after password verification but before TOTP completion is accepted by every /api route because config/packages/security.yaml protects the API with ISAUTHENTICATED and...

CVE-2026-52827 Kimai: Two-factor authentication bypass on the Kimai API

Kimai is an open-source time tracking application. Prior to 2.59.0, the KIMAISESSION cookie issued after password verification but before TOTP completion is accepted by every /api route because config/packages/security.yaml protects the API with ISAUTHENTICATED and...

CVE-2026-52827

This vulnerability affects Kimai , an open-source time tracking application, in versions prior to 2.59.0 . The root cause is that the KIMAI_SESSION cookie, issued after password verification but before TOTP completion, is accepted by all /api/* endpoints. The API firewall uses the IS_AUTHENTICATE...