GHSA-rmmc-8cqj-hfp3 Authentication Bypass in otpauth
Attackers can bypass OTP authentication by submitting single-digit tokens, allowing unauthorized access to systems using this library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-rmmc-8cqj-hfp3?
GHSA-rmmc-8cqj-hfp3 is an authentication bypass vulnerability in otpauth, published on 3 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of otpauth prior to 3.2.8 are vulnerable to Authentication Bypass. The package's totp.validate() function may return positive values for single digit tokens even if they are invalid. This may allow attackers to bypass the OTP authentication by providing single digit tokens.
Recommendation
Upgrade to version 3.2.8 or later.
Which versions are affected by GHSA-rmmc-8cqj-hfp3?
2 open source packages ship an affected version, including otpauth.
| Package | Affected | Fixed in |
|---|---|---|
otpauth npm | All versions | 3.2.8 |
otpauth npm | All versions | 3.2.8 |
How do I fix GHSA-rmmc-8cqj-hfp3?
Upgrade otpauth to 3.2.8 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is GHSA-rmmc-8cqj-hfp3 being exploited?
There is no known exploitation of GHSA-rmmc-8cqj-hfp3 in the wild and no public exploit code.