CVE-2026-94112

mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack

State: Published
Severity: 7.6 High
Published: Sep 20, 2026
Updated: Sep 21, 2026
Reserved: Sep 20, 2026

Description

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90 seconds without detection.

Scores

CVSS	Score	Vector	Source
4.0	7.6 High	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	6.8 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N	VulnCheck

Weaknesses

CWE-294 Authentication Bypass by Capture-replay

Affected Products

Product	Versions
ezBookkeepingmayswind	before 2.0.0Affected

References

GitHub Security Advisory (GHSA-p6qr-48g6-97q3)vendor-advisory
https://github.com/mayswind/ezbookkeeping/commit/3dd6286d7a3ab0f980a6d36339b9c9c4df9467e4patch
ezBookkeeping v2.0.0 Release Notesrelease-notes
VulnCheck Advisory: mayswind ezBookkeeping before 2.0.0 TOTP Replay Attackthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.