CraftCMS Plugin - Two-Factor Authentication - TOTP Token Stays Valid After Use

published 2024-06-06 2 y ago modified 2026-06-17 4 mo ago also GHSA-96qm-hwhp-2rm8 , EUVD-2024-1994

cvss: 4.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits: 0; none known

The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period.

Patch / fix

fixed in 2 links 2

packagist born05/craft-twofactorauthentication 3.3.4
born05 two-factor_authentication 3.3.4

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-06-06)

Exploit prediction

0.59% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240202-02_CraftCMS_Plugin_Two-Factor_Authentication_TOTP_Valid_After_Use referenced PoC, tagged "exploit" by a source, unverified
openwall.com http://www.openwall.com/lists/oss-security/2024/06/06/2 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.8	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
NVD	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
GitHub	3.1	4.8	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
packagist	born05/craft-twofactorauthentication	<3.3.4	3.3.4

Affected products

Born05 CraftCMS Plugin - Two-Factor Authentication
born05 craft_cms

Classification

Weakness

CWE-303 Incorrect Implementation of Authentication Algorithm
CWE-287 Improper Authentication

References

github.com /born05/craft-twofactorauthentication/commit/89d2339463c0f3ee690e707d4bc8501360885289
web
github.com /sbaresearch/advisories/tree/public/2024/SBA-ADV-20240202-02_CraftCMS_Plugin_Two-Factor_Authentication_TOTP_Va
third-party-advisory, web, exploit
openwall.com /lists/oss-security/2024/06/06/2
web, exploit, mailing-list, third-party-advisory
plugins.craftcms.com /two-factor-authentication?craft4
product, web
github.com /born05/craft-twofactorauthentication/releases/tag/3.3.4
release-notes, web
nvd.nist.gov /vuln/detail/CVE-2024-5658
advisory
github.com /born05/craft-twofactorauthentication
package

Sources

CVE List CVE-2024-5658
GitHub Advisory GHSA-96qm-hwhp-2rm8
NVD CVE-2024-5658

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary