GitHub Advisoryadvisory · PyPI

GHSA-rqg8-xjp2-pg9w LinOTP replay vulnerability with auto resynchronization enabled for TOTP token

CRITICAL Published 2022-05-24 Modified 2024-09-30 Official page ↗
Aliases
CVE-2019-12887
Ecosystem
PyPI
Packages
LinOTP
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-294
Reviewed
2024-04-29

Affected packages

• PyPI LinOTP: < 2.11.1 → fixed in 2.11.1

Description

LinOTP is prone to a replay attack with activated automatic resynchronization. This vulnerability may allow an attacker to successfully log in with OTP values recorded at a previous point in time. This attack is only possible if automatic resynchronization is enabled for the TOTP token type. The automatic resynchronization is deactivated by default. All other tokens are unaffected.

Related

Alias · CVE (1)

  • CVE-2019-12887 KeyIdentity LinOTP before 2.10.5.3 has Incorrect Access Control (issue 1 of 2). vulnerability

Weakness · CWE (1)

  • CWE-294 Authentication Bypass by Capture-replay weakness

References