What’s Vulnerable › Vulnerabilities

CVE-2024-5658: CraftCMS Plugin - Two-Factor Authentication - TOTP Token Stays Valid After Use

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-06-06 · updated 2026-06-17
• Weakness: CWE-303

Description

The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period.

Affected products

• Born05 CraftCMS Plugin - Two-Factor Authentication: before 3.3.4 — fixed in 3.3.4

How to fix

Upgrade to a fixed version: Born05 CraftCMS Plugin - Two-Factor Authentication 3.3.4. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2024/06/06/2
• https://github.com/born05/craft-twofactorauthentication/releases/tag/3.3.4
• https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240202-02_CraftCMS_Plugin_Two-Factor_Authentication_TOTP_Valid_After_Use
• https://plugins.craftcms.com/two-factor-authentication?craft4
• http://www.openwall.com/lists/oss-security/2024/06/06/2
• https://github.com/born05/craft-twofactorauthentication/releases/tag/3.3.4
• https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240202-02_CraftCMS_Plugin_Two-Factor_Authentication_TOTP_Valid_After_Use
• https://plugins.craftcms.com/two-factor-authentication?craft4

Get alerted when CVE-2024-5658 or the next vulnerability affects your stack