Executive brief
otp-generator is a library that generates one-time passwords (OTPs) used for two-factor authentication and account security. Versions before 3.0.0 use weak randomness when creating OTPs, allowing attackers to predict or brute-force valid codes, potentially bypassing authentication and gaining unauthorized access to accounts.
Technical details
The vulnerability is classified as insecure randomness (CWE-330), where the OTP generation mechanism fails to use cryptographically secure random number generation. This allows attackers to predict or brute-force OTP values with reduced computational effort compared to properly randomized tokens. The flaw affects all versions before 3.0.0; the issue was patched in version 3.0.0 as evidenced by the commit fixing the randomness implementation. No authentication is required to exploit this—an attacker only needs to attempt OTP prediction against a target account.
Affected products
- otp-generator contributors otp-generator before 3.0.0
Timeline
- 2021-07-16: disclosed
- 2022-07-25: patched: Fixed in version 3.0.0
- 2022-07-26: advisory