EUVD-2026-68127
GHSA-frwg-xgr9-44pg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector; AC:H because exploitation requires prior credential possession and real-time observation of a live TOTP code; PR:N as the attacker holds no privileges on the system prior to the attack.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor.
AnalysisAI
TOTP code replay in Rodauth before 2.47.0 allows an attacker who has already obtained a victim's credentials and observed a valid one-time password to reuse that code within the configured drift window, bypassing the second authentication factor. The otp feature lacked any mechanism to record when a code was last accepted, so a single 30-second TOTP token could authenticate multiple distinct sessions during the drift period. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two prerequisites must be satisfied: the attacker must already possess the target account's username and password (the first authentication factor), and must observe or intercept a valid TOTP code submitted during an active authentication session. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.1 with PR:H reflects that exploitation demands the attacker already possess the target account password and then observe or intercept a live TOTP code - preconditions that substantially limit opportunistic mass exploitation and make this a targeted-threat concern rather than a commodity risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Rodauth 2.47.0 or later, which incorporates commit 3bfd0a11bae70935b1944e71dbe787dd0c3a62ad adding the :after=>otp_last_use argument to ROTP's verify call. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in Rodauth (the Ruby authentication framework by Jeremy Evans, jeremyevans:rodauth) before 2.46.0
JWT access token indefinite renewal in Rodauth before 2.47.0 allows an attacker who possesses a valid access token to by
Open redirect in Rodauth before 2.47.0 enables post-authentication phishing by failing to reject protocol-relative retur
CSRF protection bypass in Rodauth before 2.47.0 allows remote attackers to force victims into authenticated sessions und
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today