Medium severity6.8NVD Advisory· Published Sep 20, 2026
CVE-2026-94112
CVE-2026-94112
Description
mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90 seconds without detection.
Patches
Vulnerability mechanics
References
4- github.com/mayswind/ezbookkeeping/commit/3dd6286d7a3ab0f980a6d36339b9c9c4df9467e4nvd
- github.com/mayswind/ezbookkeeping/releases/tag/v2.0.0nvd
- github.com/mayswind/ezbookkeeping/security/advisories/GHSA-p6qr-48g6-97q3nvd
- www.vulncheck.com/advisories/mayswind-ezbookkeeping-before-2.0.0-totp-replay-attacknvd
News mentions
0No linked articles in our index yet.