CVE-2026-94112
Received Received - Intake

TOTP Replay Vulnerability in ezBookkeeping

Publication date: 2026-09-20

Last updated on: 2026-09-20

Assigner: VulnCheck

Description
mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90 seconds without detection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-20
Last Modified
2026-09-20
Generated
2026-09-20
AI Q&A
2026-09-20
EPSS Evaluated
N/A
NVD
CVE-2026-94112
EUVD
EUVD-2026-83734

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mayswind ezbookkeeping to 2.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-294 A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in mayswind ezBookkeeping before 2.0.0 allows attackers to reuse captured TOTP passcodes within a 90-second window after the legitimate user has used them. The application fails to invalidate passcodes after single use, violating the one-time use security measure. This enables replay attacks where stolen credentials can be used multiple times without detection.

Detection Guidance

Detecting this vulnerability requires monitoring for duplicate TOTP code usage within the 90-second window. Check server logs for multiple successful authentications using the same TOTP code. Look for repeated JWT token generation from the same user session. Inspect network traffic for repeated 2FA code submissions from the same IP.

Impact Analysis

Attackers with stolen credentials can authenticate and reuse a captured passcode for approximately 90 seconds without detection. This allows unauthorized access to accounts, potential data theft, and misuse of application features. The impact includes compromised accounts, unauthorized transactions, and prolonged access due to the 7-day JWT session lifetime.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Non-compliance may result in legal penalties, reputational damage, and loss of trust due to inadequate access controls and session management.

Mitigation Strategies

Upgrade to ezBookkeeping version 2.0.0 or later immediately. Implement a used-code tracking system to invalidate TOTP codes after first use. Store used codes in a short-lived cache (e.g., Redis) with a 60-second TTL. Monitor for duplicate code usage attempts in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94112. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart