CVE-2021-43177
Improper one time password handling in devise-two-factor
As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
- Record
CVE-2021-43177- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:P/I:N/A:N - Weakness
- CWE-254
- Updated
- 2026-11-02
CVE List No score
As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
- Record
CVE-2021-43177- Weakness
- CWE-254
- Updated
- 2026-11-02
EUVDEUVD-2022-1774 No score
As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
- Record
EUVD-2022-1774- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jm35-h8q2-73mp
Improper one time password handling in devise-two-factor
Impact
As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval.
Patches
This vulnerability has been patched in version 4.0.2 which was released on March 24th, 2022. Individuals using this package are strongly encouraged to upgrade as soon as possible.
Credit for discovery
Benoit Côté-Jodoin Michael Nipper - https://github.com/tinfoil/devise-two-factor/issues/106
- Record
GHSA-jm35-h8q2-73mp- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSV
As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
- Record
CVE-2021-43177- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-43177
As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
- Record
DEBIAN-CVE-2021-43177- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-jm35-h8q2-73mp
Improper one time password handling in devise-two-factor
Impact
As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval.
Patches
This vulnerability has been patched in version 4.0.2 which was released on March 24th, 2022. Individuals using this package are strongly encouraged to upgrade as soon as possible.
Credit for discovery
Benoit Côté-Jodoin Michael Nipper - https://github.com/tinfoil/devise-two-factor/issues/106
- Record
GHSA-jm35-h8q2-73mp- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-43177
As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
- Record
UBUNTU-CVE-2021-43177- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUSN-7050-1 No score
ruby-devise-two-factor vulnerabilities
Benoit Côté-Jodoin and Michael Nipper discovered that Devise-Two-Factor incorrectly handled one-time password validation. An attacker could possibly use this issue to intercept and re-use a one-time password. (CVE-2021-43177)
Garrett Rappaport discovered that Devise-Two-Factor incorrectly handled generating multi-factor authentication codes. An attacker could possibly use this issue to generate valid multi-factor authentication codes. (CVE-2024-8796)
- Record
USN-7050-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
devise-two-factorRubyGems |
before 4.0.2 | 4.0.2 |
ruby-devise-two-factorDebian:12 |
before 4.0.2-1 | 4.0.2-1 |
devise-two-factorRubyGems |
before 4.0.2, plus listed versions 1.0.01.0.11.0.21.1.02.0.0 Show 11 moreShow less2.0.12.1.02.2.02.2.13.0.03.0.13.0.23.0.33.1.04.0.04.0.1 |
4.0.2 |
ruby-devise-two-factorUbuntu:16.04:LTS |
All versions, plus listed versions 1.1.0-12.0.0-1 |
None known |
ruby-devise-two-factorUbuntu:Pro:20.04:LTS |
before 3.1.0-2ubuntu0.1~esm1, plus listed versions 3.0.3-23.1.0-2 |
3.1.0-2ubuntu0.1~esm1 |
ruby-devise-two-factorUbuntu:Pro:22.04:LTS |
before 4.0.0-2ubuntu0.1~esm1, plus listed versions 3.1.0-24.0.0-2 |
4.0.0-2ubuntu0.1~esm1 |
ruby-devise-two-factorUbuntu:Pro:20.04:LTS From an advisory covering 2 CVEs |
before 3.1.0-2ubuntu0.1~esm1, plus listed versions 3.0.3-23.1.0-2 |
3.1.0-2ubuntu0.1~esm1 |
ruby-devise-two-factorUbuntu:Pro:22.04:LTS From an advisory covering 2 CVEs |
before 4.0.0-2ubuntu0.1~esm1, plus listed versions 3.1.0-24.0.0-2 |
4.0.0-2ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-43177 is a medium vulnerability (CVSS 5.3) in Devise-two-factor, published April 7, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.88%, the 59th percentile. Fixed in devise-two-factor 4.0.2.
References
github.com/tinfoil/devise-two-factor/security/advisories/GHSA-jm35-h8q2-73mp
nvd.nist.gov/vuln/detail/CVE-2021-43177
security-tracker.debian.org/tracker/CVE-2021-43177
Show 7 moreShow less
ubuntu.com/security/CVE-2021-43177
cve.org/CVERecord?id=CVE-2021-43177