CVE-2015-7225

Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2
of RFC 6238 and does not “burn” a successfully validated one-time password
(aka OTP), which allows remote or physically proximate attackers with a
target user’s login credentials to log in as said user by obtaining the OTP
through performing a man-in-the-middle attack between the provider and
verifier, or shoulder surfing, and replaying the OTP in the current
time-step.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798466&gt;