Executive brief
Rodauth is a popular Ruby authentication framework that supports time-based one-time passwords (TOTP) as a second authentication factor. This vulnerability allows attackers who capture a valid TOTP code to replay it during a time-window period to bypass the second factor protection, potentially gaining unauthorized access to user accounts.
Technical details
The vulnerability is a time-based one-time password (TOTP) reuse flaw in Rodauth's OTP feature. The root cause is that the framework failed to track the timestamp of the last accepted TOTP code, allowing replay attacks during the OTP drift window. An attacker with network access who observes a valid TOTP code can resubmit it within the drift period to bypass second-factor authentication. The fix, implemented in version 2.47.0, uses the ROTP library's `verify` method with an `at` argument to track and prevent reuse by comparing against the last-used timestamp. This requires a reasonably recent version of the ROTP dependency.
Affected products
- Jeremy Evans Rodauth before 2.47.0
Timeline
- 2026-08-29: disclosed
- 2026-08-29: patched: Fixed in version 2.47.0