GitHub Advisoryadvisory · npm

GHSA-rmmc-8cqj-hfp3 Authentication Bypass in otpauth

HIGH Published 2020-09-03 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
otpauth
Severity
High
Weaknesses
CWE-287
Reviewed
2020-08-31

Affected packages

• npm otpauth: < 3.2.8 → fixed in 3.2.8

Description

Versions of `otpauth` prior to 3.2.8 are vulnerable to Authentication Bypass. The package's `totp.validate()` function may return positive values for single digit tokens even if they are invalid. This may allow attackers to bypass the OTP authentication by providing single digit tokens. Recommendation Upgrade to version 3.2.8 or later.

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References