CVE-2026-82470: Rodauth before 2.47.0 TOTP Code Reuse via Drift Window
Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to observe a valid TOTP code and have the privileges required to authenticate to the affected application. The issue is remotely exploitable and does not require user interaction.
What versions are affected, and what fixes the issue?
Rodauth versions before 2.47.0 are affected. Upgrading to version 2.47.0 or later addresses the missing tracking of the last accepted code timestamp.
What is the practical impact of successful exploitation?
A captured valid TOTP code can be replayed while it remains within the configured drift window, allowing the attacker to bypass the second authentication factor. The reported impact includes low confidentiality and integrity impact, with no availability impact.