CVE-2025-55000 OpenBao TOTP Secrets Engine Enables Code Reuse

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictly-once. This was caused by unexpected...

CVE-2025-55000 OpenBao TOTP Secrets Engine Enables Code Reuse

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictly-once. This was caused by unexpected...

OpenBao 安全漏洞

OpenBao is OpenBao open source a sensitive data management software . A security vulnerability exists in OpenBao versions 0.1.0 through 2.3.1, which stems from the TOTP key engine being able to accept valid code multiple times, and no details of the vulnerability are provided at this time...

GHSA-F7C3-MHJ2-9PVG OpenBao TOTP Secrets Engine Code Reuse

Impact OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictly-once. This was caused by unexpected normalization in the underlying TOTP library. Patches OpenBao v2.3.2 will patch this issue. In patching, codes which were not normalized strictly N numeric digits...

PT-2025-32384

Name of the Vulnerable Software and Affected Versions OpenBao versions 2.3.1 and below Description OpenBao’s Login Multi-Factor Authentication MFA system, utilizing Time-based One Time Password TOTP, accepted codes containing whitespace due to normalization applied by the underlying TOTP library...

PT-2025-32382

Name of the Vulnerable Software and Affected Versions OpenBao versions 0.1.0 through 2.3.1 Description OpenBao’s TOTP secrets engine could accept valid Time-based One-Time Password TOTP codes multiple times instead of strictly once. This issue stemmed from unexpected normalization within the...

Improper Restriction of Excessive Authentication Attempts

Overview github.com/hashicorp/vault/vault is a tool for securely accessing secrets. Affected versions of this package are vulnerable to Improper Restriction of Excessive Authentication Attempts via validateTOTP when enforcing the once-per-validity-window check. An attacker could gain unauthorized...

CVE-2025-6014 Vault TOTP Secrets Engine Code Reuse

Vault and Vault Enterprise’s “Vault” TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23...

Vault TOTP Secrets Engine Code Reuse

Summary Vault and Vault Enterprise’s “Vault” TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. This vulnerability, identified as CVE-2025-6014, is fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23...

HashiCorp Vault Enterprise和HashiCorp Vault Community Edition 安全漏洞

HashiCorp Vault Enterprise and HashiCorp Vault Community Edition are both products of HashiCorp, Inc. of the U.S.A. HashiCorp Vault Enterprise is an enterprise information archiving platform.HashiCorp Vault HashiCorp Vault Enterprise is an enterprise information archiving platform and HashiCorp...

HashiCorp Vault Enterprise和HashiCorp Vault Community Edition 安全漏洞

HashiCorp Vault Enterprise and HashiCorp Vault Community Edition are both products of HashiCorp, Inc. of the U.S.A. HashiCorp Vault Enterprise is an enterprise information archiving platform.HashiCorp Vault HashiCorp Vault Enterprise is an enterprise information archiving platform, and HashiCorp...

Quest KACE Systems Management Appliance 安全漏洞

Quest Software Quest KACE Systems Management Appliance is an IT asset management appliance from Quest Software, USA. A security vulnerability exists in the Quest KACE Systems Management Appliance that stems from a logical flaw in the implementation of two-factor authentication, which could lead t...

The vulnerability of the TOTP (Time-based One-Time Password) algorithm used by the SINEMA Remote Connect VPN service allows a perpetrator to bypass the authentication process.

The vulnerability of the TOTP Time-based One-Time Password algorithm used by the SINEMA Remote Connect VPN service lies in the incorrect validity period of the session. Exploiting this vulnerability could allow an attacker to bypass the authentication process remotely...

Devise-Two-Factor 安全漏洞

Devise-Two-Factor is a minimalist extension of Devise to the Devise-Two-Factor open source. It is used to provide support for two-factor authentication via TOTP schemes. A security vulnerability exists in Devise-Two-Factor versions 2.2.0 and earlier and 6.0.0 and earlier, which stems from an...

Craft CMS 安全漏洞

Craft CMS is Craft CMS open source content management system CMS. An access control error vulnerability exists in Craft CMS versions 5.0.0-beta.1 through 5.2.2, which stems from allowing multiple reuses of a TOTP token during its validity period. An attacker can exploit the vulnerability by...

CVE-2022-45168

An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication can occur under the /login/backupcode endpoint and the /api/v1/vdeskintegration/createbackupcodes endpoint, because the application allows a user to generate or regenerate the backup codes...

LIVEBOX Collaboration vDesk Security Vulnerability

LIVEBOX Collaboration vDesk is an application from LIVEBOX, Inc. A security vulnerability exists in LIVEBOX Collaboration vDesk v018 and prior versions, which stems from the application allowing a user to generate or regenerate backup code prior to checking TOTP, where a two-factor authentication...

CraftCMS Security Vulnerability

CraftCMS is a content management system from CraftCMS, Inc. A security vulnerability exists in the CraftCMS plugin Two-Factor Authentication version 3.3.1, version 3.3.2, and version 3.3.3, which stems from a vulnerability that allows for multiple reuse of TOTP tokens during the validity period...

PT-2024-24923 · Zitadel · Zitadel

Name of the Vulnerable Software and Affected Versions: ZITADEL versions prior to 2.50.0 Description: ZITADEL provides users the possibility to use Time-based One-Time-Password TOTP and One-Time-Password OTP through SMS and Email. While ZITADEL already gives administrators the option to define a...

Number withdrawn

Devise-Two-Factor is a minimalist extension to Devise. It is used to provide support for two-factor authentication through the TOTP scheme. This CVE number has been withdrawn...