Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timest...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Ubuntu:26.10 ruby-rodauth

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

参照URL

report ubuntu.com
report cve.org
report github.com
report github.com
report github.com
report vulncheck.com