-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from an insufficient time window calculation for TOTP token validity checks. The pre-patch code in both isTokenUsed and removeOldTokens calculated the start time as 'now - totpDelay', which only accounted for clock drift compensation but not the full 30-second TOTP window. This allowed tokens to be reused within the validity period. The patch introduced getTotpStartTime() to calculate a 31+delay second window (covering the standard 30s TOTP period + buffer), directly addressing both functions' flawed time calculations.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| born05/craft-twofactorauthentication | composer | < 3.3.4 | 3.3.4 |
PHPPHPOngoing coverage of React2Shell