GHSA-rmmc-8cqj-hfp3
Authentication Bypass in otpauth
GHSA-rmmc-8cqj-hfp3 is a vulnerability with no CVSS score yet in otpauth, published September 3, 2020. No source lists public exploit code. Fixed in otpauth 3.2.8.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.2.8otpauth
Description
Versions of otpauth prior to 3.2.8 are vulnerable to Authentication Bypass. The package's totp.validate() function may return positive values for single digit tokens even if they are invalid. This may allow attackers to bypass the OTP authentication by providing single digit tokens.
Recommendation
Upgrade to version 3.2.8 or later.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
otpauthnpm | before 3.2.8 | 3.2.8 |
What each source reports
GitHub AdvisoriesNo score
Authentication Bypass in otpauth
Versions of otpauth prior to 3.2.8 are vulnerable to Authentication Bypass. The package's totp.validate() function may return positive values for single digit tokens even if they are invalid. This may allow attackers to bypass the OTP authentication by providing single digit tokens.
Recommendation
Upgrade to version 3.2.8 or later.
- Record
GHSA-rmmc-8cqj-hfp3- Weakness
- CWE-287
- Updated
- 2026-11-02
OSVNo score
Authentication Bypass in otpauth
Versions of otpauth prior to 3.2.8 are vulnerable to Authentication Bypass. The package's totp.validate() function may return positive values for single digit tokens even if they are invalid. This may allow attackers to bypass the OTP authentication by providing single digit tokens.
Recommendation
Upgrade to version 3.2.8 or later.
- Record
GHSA-rmmc-8cqj-hfp3- Weakness
- CWE-287
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.