Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
- Snyk ID SNYK-RUBY-DEVISETWOFACTOR-20239
- published 16 Sep 2015
- disclosed 16 Sep 2015
- credit Viliam Holub
Affected versions do not mark used TOTP (Time-Based One-Time Password) verification codes once used, and allow their reuse during the timestep period of the code. This can be exploited by an attacker with knowledge of the authentication credentials AND access to the TOTP verification code that was just used.