This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-82470 →

DEBIAN-CVE-2026-82470

Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timest...

Original description

The description as published by the source.

Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:14 ruby-rodauth

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.0-1"}]}]

References

advisory security-tracker.debian.org