CVE-2021-43177: Improper one time password handling in devise-two-factor

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-04-11 · updated 2026-06-17
Weakness: CWE-254

Description

As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)

Affected products

devise-two-factor: before 4.0.2 — fixed in 4.0.2
Rubygems Devise-Two-Factor: before 4.0.2; 1.0.0, 1.0.1, 1.0.2, 1.1.0, 2.0.0, 2.0.1 (+10) — fixed in 4.0.2

How to fix

Upgrade to a fixed version: devise-two-factor 4.0.2; Rubygems Devise-Two-Factor 4.0.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-43177 or the next vulnerability affects your stack