Description
Versions of otpauth prior to 3.2.8 are vulnerable to Authentication Bypass. The package’s totp.validate() function may return positive values for single digit tokens even if they are invalid. This may allow attackers to bypass the OTP authentication by providing single digit tokens.
Recommendation
Update the otpauth package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.2.8
- Patched version(s): 3.2.8
References
Could your website be exposed too?
SmartScanner can check your website for Authentication Bypass in otpauth and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Authentication Bypass in @strapi/plugin-users-permissions - Vulnerability
- cap-go/capacitor-native-biometric Authentication Bypass - Vulnerability
- Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy - CVE-2026-42041
- validator.js has a URL validation bypass vulnerability in its isURL function - CVE-2025-56200
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023