CVE-2022-25838 Multi-Factor Authentication issue in Laravel Fortify
Attackers can reuse TOTP codes within a short window, bypassing two-factor authentication in Laravel Fortify.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-25838?
CVE-2022-25838 is a high-severity vulnerability in n/a, published on 24 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept.
Weakness: CWE-294
Which versions are affected by CVE-2022-25838?
2 open source packages ship an affected version, including laravel/fortify. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
laravel/fortify Packagist | All versions | 1.11.1 |
laravel/fortify Packagist | All versions | 1.11.1 |
Products include Laravel Fortify.
How do I fix CVE-2022-25838?
Upgrade laravel/fortify to 1.11.1 or later.
Is CVE-2022-25838 being exploited?
There is no known exploitation of CVE-2022-25838 in the wild and no public exploit code.
Sources
Also known as GHSA-6w4v-qr4m-97gg.