WS-2019-0187

Versions of otpauth prior to 3.2.8 are vulnerable to Authentication Bypass. The package's totp.validate function may return positive values for single digit tokens even if they are invalid. This may allow attackers to bypass the OTP authentication by providing single digit tokens...

Information Disclosure

otpauth is vulnerable to information disclosure. The vulnerability exists through a non constant-time comparison algorithm is being used for validating a HOTP token...

Authentication Bypass in otpauth

Versions of otpauth prior to 3.2.8 are vulnerable to Authentication Bypass. The package's totp.validate function may return positive values for single digit tokens even if they are invalid. This may allow attackers to bypass the OTP authentication by providing single digit tokens. Recommendation...

PT-2020-21494

Name of the Vulnerable Software and Affected Versions otpauth versions prior to 3.2.8 Description The issue allows attackers to bypass OTP authentication by providing single digit tokens, as the totp.validate function may return positive values for invalid single digit tokens. Recommendations...

Authentication Bypass

Overview Versions of otpauth prior to 3.2.8 are vulnerable to Authentication Bypass. The package's totp.validate function may return positive values for single digit tokens even if they are invalid. This may allow attackers to bypass the OTP authentication by providing single digit tokens...