Listen to this Post
How the CVE Works
The vulnerability in OpenBao’s TOTP secrets engine allows valid Time-based One-Time Password (TOTP) codes to be reused due to improper normalization in the underlying library. Normally, TOTP codes should be accepted only once to prevent replay attacks. However, due to unexpected normalization, the system fails to enforce this strict single-use policy. Attackers exploiting this flaw could submit the same valid code multiple times, bypassing security measures designed to ensure code uniqueness. The issue affects versions before 2.3.2, where improperly formatted codes were processed without rejection.
DailyCVE Form
Platform: OpenBao
Version: >= 0.1.0, < 2.3.2
Vulnerability: TOTP code reuse
Severity: Critical
Date: Aug 8, 2025
Prediction: Patch expected by Aug 15, 2025
What Undercode Say
Analytics:
$ curl -X POST https://openbao.example.com/v1/totp/verify -d '{"code":"123456"}'
if !normalized(code) {
rejectCode()
}
How Exploit
1. Capture valid TOTP code.
2. Submit same code repeatedly.
3. Bypass single-use enforcement.
Protection from this CVE
- Upgrade to OpenBao v2.3.2.
- Normalize codes before submission.
- Restrict TOTP verification access.
Impact
- TOTP replay attacks possible.
- Weakens MFA security.
- Breaking changes in patched version.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
