Description

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90 seconds without detection.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-20T12:17:06.953Z",
  "pubdate": "2026-09-20T12:17:06.953Z",
  "executiveSummary": "The vulnerability identified in mayswind ezBookkeeping versions prior to 2.0.0 pertains to a critical failure in the Time-based One-Time Password (TOTP) validation logic.\nSpecifically, the application fails to enforce the 'one-time' requirement of passcodes, allowing for the reuse of a single TOTP code within the standard drift/acceptance window.\nThis flaw effectively bypasses the multi-factor authentication (MFA) security control, as an attacker in possession of a valid set of user credentials and a captured TOTP code can perform multiple authorization attempts.\nThe window of opportunity for exploitation is approximately 90 seconds, corresponding to the duration for which the TOTP code remains valid on the server side.\nThis vulnerability significantly reduces the efficacy of MFA, as it transforms a ephemeral credential into a reusable one during the defined acceptance window.\nExploitation requires an attacker to have already compromised primary user credentials and intercepted a legitimate TOTP code, typically via man-in-the-middle or credential harvesting techniques.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper state management of the TOTP validation process within the ezBookkeeping authentication module.\nStandard TOTP implementations (RFC 6238) require that once a specific time-step passcode has been successfully validated, it must be blacklisted or invalidated until the time window has expired to prevent replay attacks.\nIn affected versions of ezBookkeeping, the system verifies the validity of the provided TOTP code against the secret key and current system time but fails to record or track the use of that specific code for the remainder of the 90-second validity window.\nConsequently, the authentication backend does not implement a 'used token' check, allowing subsequent requests to be authenticated successfully using the exact same token if submitted within the acceptable time drift window.\nThe attack flow proceeds as follows: First, an attacker obtains valid primary authentication credentials for a target account. Second, the attacker performs an adversary-in-the-middle attack or uses social engineering to intercept a valid TOTP code generated by the user's authenticator application.\nThird, the attacker transmits the credentials along with the intercepted TOTP code to the ezBookkeeping login endpoint. The server validates the code and grants access. Fourth, because the server does not invalidate the token, the attacker can submit additional authorization requests or replay the request against sensitive endpoints that may require secondary authentication, successfully passing the challenge multiple times within the 90-second window.\nThis vulnerability is present in versions prior to 2.0.0 and affects the primary authentication component. It requires network access to the target login endpoint and prior compromise of user credentials. The post-exploitation impact includes successful unauthorized access to the application, potentially leading to unauthorized data modification or administrative account takeover if the MFA mechanism was the primary defense protecting high-privilege sessions.\nBy failing to enforce strictly non-repeating tokens, the application essentially degrades TOTP security to that of a static short-lived password, fundamentally violating the principles of MFA."
}