-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| craftcms/cms | composer | >= 5.0.0-beta.1, <= 5.2.2 | 5.2.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper TOTP validation logic in the verify method. The original implementation used verifyKey() from the Google2FA library without tracking usage timestamps, violating RFC 6238's one-time use requirement. The patch replaced verifyKey() with verifyKeyNewer() and added timestamp tracking through lastUsedTimestamp/storeLastUsedTimestamp. The vulnerable versions lacked this stateful validation, enabling token reuse. The high confidence comes from the direct correlation between the vulnerability description and the patched code changes in this function.