Back to Database
Status published
Medium
CVE-2024-5658
CraftCMS Plugin - Two-Factor Authentication - TOTP Token Stays Valid After Use
Vulnerability Description
The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-5658
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Fabian Funder (SBA Research)
- Jakob Pachmann (SBA Research)
References
- https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240202-02_CraftCMS_Plugin_Two-Factor_Authentication_TOTP_Valid_After_Use
- https://plugins.craftcms.com/two-factor-authentication?craft4
- https://github.com/born05/craft-twofactorauthentication/releases/tag/3.3.4
- http://www.openwall.com/lists/oss-security/2024/06/06/2
Affected Vendor
Born05
View all reports →Affected Software
CraftCMS Plugin - Two-Factor Authentication
Vulnerable Versions:
0
Timeline
Official Publish:
June 6th, 2024
Last Modified:
September 3rd, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
Weaknesses (CWE)
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.