Authentication Bypass in otpauth
Summary
GHSA-rmmc-8cqj-hfp3: Authentication Bypass in otpauth. Affects otpauth versions < 3.2.8. Fixed in 3.2.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The otpauth package is an npm package that provides functionality for generating and validating one-time passwords (OTP). It is commonly used in applications that require two-factor authentication (2FA) or OTP-based authentication. The package allows users to generate and validate OTPs using the Time-based One-Time Password (TOTP) algorithm.
Vulnerability Detail
Versions of otpauth prior to 3.2.8 are vulnerable to an Authentication Bypass vulnerability. The package's totp.validate() function may incorrectly validate single digit tokens, allowing attackers to bypass OTP authentication by providing invalid single digit tokens. This vulnerability can potentially lead to unauthorized access to systems or accounts protected by OTP authentication.
How To Fix
Minimum fixed version
3.2.8
This is the first release that contains the fix.
npm install otpauth@3.2.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the otpauth package to mitigate the risk of authentication bypass.
Conclusion
The otpauth package prior to version 3.2.8 is vulnerable to an authentication bypass issue that allows attackers to bypass OTP authentication by providing single digit tokens. To mitigate this vulnerability, it is crucial to upgrade to version 3.2.8 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for otpauth →
FAQ
This vulnerability allows attackers to bypass OTP authentication by providing single digit tokens, potentially leading to unauthorized access to systems or accounts.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for vulnerabilities in real-time.
Yes, all versions of otpauth prior to 3.2.8 are vulnerable to this authentication bypass issue.
Yes, upgrading to version 3.2.8 or later of the otpauth package fixes this vulnerability.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
