CVE-2026-94112CWE-294

CVE-2026-94112

Medium · published September 20, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
32.3
In the wild
Unconfirmed
What it is

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90 seconds without detection.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
7.6 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00393 · 32.3th percentile
Weakness
CWE-294 · Authentication Bypass by Capture-replay
Published
2026-09-20T16:17Z
References (4)
https://github.com/mayswind/ezbookkeeping/commit/3dd6286d7a3ab0f980a6d36339b9c9c4df9467e4 · [email protected]https://github.com/mayswind/ezbookkeeping/releases/tag/v2.0.0 · [email protected]https://github.com/mayswind/ezbookkeeping/security/advisories/GHSA-p6qr-48g6-97q3 · [email protected]https://www.vulncheck.com/advisories/mayswind-ezbookkeeping-before-2.0.0-totp-replay-attack · [email protected]
EPSS history
Timeline
  • 22 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 20 SEP 11:56Z
    mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack
    cvelistv5