CVE-2026-94112
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90 seconds without detection.
Risk Assessment
The risk includes unauthorized access to user accounts even when two-factor authentication is enabled, which could lead to financial data compromise.
Recommendation
It is recommended to upgrade ezBookkeeping to version 2.0.0 or later, which invalidates TOTP codes after use, and to consider additional security mechanisms.
Other vulnerabilities in ezBookkeeping
Original NVD description (English source)
mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90 seconds without detection.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS