GitHub Advisoryadvisory · npm

GHSA-6x93-h9g3-9phr otp-generator before v3.0.0 insecurely generates random one-time passwords

CRITICAL Published 2022-07-26 Modified 2022-08-06 Official page ↗
Aliases
CVE-2021-23451
Ecosystem
npm
Packages
otp-generator
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-330
Reviewed
2022-08-06

Affected packages

• npm otp-generator: < 3.0.0 → fixed in 3.0.0

Description

The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack.

Related

Alias · CVE (1)

  • CVE-2021-23451 The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which… vulnerability

Weakness · CWE (1)

  • CWE-330 Use of Insufficiently Random Values weakness

References