Time-Based One-Time Password (TOTP) Reuse Affecting devise-two-factor Open this link in a new tab package, versions < 2.0.0

  • Attack Complexity


  • Confidentiality


Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id


  • published

    16 Sep 2015

  • disclosed

    16 Sep 2015

  • credit

    Viliam Holub


devise-two-factor is a two-factor authentication addition to devise.

Affected versions do not mark used TOTP (Time-Based One-Time Password) verification codes once used, and allow their reuse during the timestep period of the code. This can be exploited by an attacker with knowledge of the authentication credentials AND access to the TOTP verification code that was just used.