What’s Vulnerable › Vulnerabilities

CVE-2026-94112: mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-20 · updated 2026-09-24
• Weakness: CWE-294

Description

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90 seconds without detection.

Affected products

• mayswind ezBookkeeping: before 2.0.0 — fixed in 2.0.0

How to fix

Upgrade to a fixed version: mayswind ezBookkeeping 2.0.0. Check the vendor advisory for mitigations.

References

• https://github.com/mayswind/ezbookkeeping/commit/3dd6286d7a3ab0f980a6d36339b9c9c4df9467e4
• https://github.com/mayswind/ezbookkeeping/releases/tag/v2.0.0
• https://github.com/mayswind/ezbookkeeping/security/advisories/GHSA-p6qr-48g6-97q3
• https://www.vulncheck.com/advisories/mayswind-ezbookkeeping-before-2.0.0-totp-replay-attack

Get alerted when CVE-2026-94112 or the next vulnerability affects your stack