CVE-2025-42615
BaseFortify
Publication date: 2025-12-08
Last updated on: 2025-12-08
Assigner: ENISA
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vulnerability-lookup | vulnerability-lookup | 2.18.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-307 | The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Vulnerability-Lookup before version 2.18.0 involves the lack of tracking or limiting failed One-Time Password (OTP) attempts during Two-Factor Authentication (2FA). An attacker who knows or guesses a valid username and password can submit unlimited OTP codes without triggering account lockout or alerts, making brute-force attacks on 2FA codes easier and increasing the risk of account takeover.
How can this vulnerability impact me? :
The vulnerability lowers the cost and difficulty of brute-force attacks against 2FA codes, increasing the risk that an attacker can successfully take over user accounts. Since administrators do not receive alerts or visibility into repeated failed OTP attempts, detecting and investigating targeted attacks becomes harder, potentially leading to unauthorized access and compromise of sensitive accounts.
What immediate steps should I take to mitigate this vulnerability?
Apply the patch to upgrade Vulnerability-Lookup to version 2.18.0 or later, which introduces a persistent failed_otp_attempts counter, locks user accounts after 5 invalid OTP submissions, resets the counter on successful verification, and surfaces failed 2FA attempts in the admin user list. This enforces account lockout policies and improves monitoring of suspicious 2FA activity.