laravel/fortify · Security
Multi-Factor Authentication issue in Laravel Fortify
- GHSA ID
- GHSA-6w4v-qr4m-97gg
- CVE ID
- CVE-2022-25838
- Severity
- high
- Published
- Updated
- CVSS
- 8.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 8.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept.
CWEs
- CWE-294 · Authentication Bypass by Capture-replay
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-25838 ↗
- https://github.com/laravel/fortify/issues/201 ↗
- https://github.com/laravel/fortify/pull/357 ↗
- https://github.com/laravel/fortify/pull/358 ↗
- https://github.com/laravel/fortify/issues/201#issuecomment-1009282153 ↗
- https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/fortify/CVE-2022-25838.yaml ↗
- https://github.com/advisories/GHSA-6w4v-qr4m-97gg ↗