CVE-2026-94112 in ezBookkeeping
Summary
by MITRE • 09/20/2026
mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90 seconds without detection.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/20/2026
The vulnerability in mayswind ezBookkeeping versions prior to 2.0.0 represents a critical failure in the implementation of Two-Factor Authentication mechanisms, specifically concerning the lifecycle management of Time-based One-Time Passwords or TOTP passcodes. In secure authentication systems, once a one-time password is successfully validated and used to grant access, it must be immediately invalidated at the server side to prevent its reuse. However, this software fails to enforce such invalidation logic, leaving the generated codes valid for their entire time window regardless of whether they have already been consumed by an authenticated session. This architectural flaw fundamentally undermines the security model of multi-factor authentication, which relies on the uniqueness and single-use nature of each passcode to ensure that possession of a static credential combined with a dynamic code provides robust identity verification.
From a technical perspective, this deficiency allows for straightforward replay attacks where an adversary who has intercepted or stolen user credentials can exploit the persistence of valid TOTP codes. When a legitimate user enters their password and corresponding TOTP code during login, the system authenticates them but does not mark that specific code instance as used in its backend state management. Consequently, if an attacker captures this passcode through network sniffing, keylogging, or other credential theft methods, they can reuse it to authenticate against subsequent authorization attempts within the standard acceptance window of approximately ninety seconds. This behavior contradicts best practices for secure session handling and violates the principle that one-time credentials should be ephemeral and non-reusable after their initial validation event.
The operational impact of this vulnerability is severe, particularly in financial or accounting software like ezBookkeeping where sensitive data integrity and access control are paramount. An attacker with stolen username-password pairs can effectively bypass the second factor of authentication by replaying a previously captured TOTP code. This enables unauthorized access to user accounts without needing real-time interception of new codes during every login attempt, significantly lowering the barrier for exploitation. The ninety-second window provides ample time for an attacker to perform multiple brute-force or automated attempts using the same valid passcode, potentially leading to data exfiltration, financial fraud, or further lateral movement within a compromised network environment if these credentials are reused elsewhere.
This vulnerability aligns with CWE-294, which describes authentication bypass by capture-replay of credentials, and maps directly to MITRE ATT&CK technique T1078, specifically the Valid Accounts subtechnique where attackers leverage stolen or captured valid account information to gain access. To mitigate this risk, it is imperative that system administrators upgrade immediately to version 2.0.0 or later, which presumably corrects the state management logic for TOTP validation. In environments where upgrading is not instantly feasible, implementing a reverse proxy with strict rate limiting and session tracking can help detect anomalous authentication patterns indicative of replay attacks. Additionally, organizations should enforce MFA policies that utilize hardware tokens or push-based notifications rather than time-based codes when possible, as these methods often include built-in mechanisms to prevent reuse upon initial acceptance.