opf openproject up to 17.2.x Setting confirm_otp excessive authentication

Summaryinfo

A vulnerability classified as problematic was found in opf openproject up to 17.2.x. This issue affects the function confirm_otp of the component Setting Handler. Such manipulation leads to excessive authentication. This vulnerability is uniquely identified as CVE-2026-33667. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in opf openproject up to 17.2.x. It has been rated as problematic. Affected by this issue is the function confirm_otp of the component Setting Handler. The manipulation with an unknown input leads to a excessive authentication vulnerability. Using CWE to declare the problem leads to CWE-307. The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks. Impacted is confidentiality. CVE summarizes:

OpenProject is an open-source project management application. In versions prior to 17.3.0, 2FA OTP verification in the confirm_otp action of the two_factor_authentication module has no rate limiting, lockout mechanism, or failed-attempt tracking. The existing brute_force_block_after_failed_logins setting only counts password login failures and does not apply to the 2FA verification stage, and neither the fail_login nor stage_failure methods increment any counter, lock the account, or add any delay. With the default TOTP drift window of ±60 seconds allowing approximately 5 valid codes at any time, an attacker who knows a user's password can brute-force the 6-digit TOTP code at roughly 5-10 attempts per second with an expected completion time of approximately 11 hours. The same vulnerability applies to backup code verification. This effectively allows complete 2FA bypass for any account where the password is known. This issue has been fixed in version 17.3.0.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-33667 since 03/23/2026. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1110.001.

Upgrading to version 17.3.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• opf

Name

• openproject

Version

• 17.0
• 17.1
• 17.2

Website

• Product: https://github.com/opf/openproject/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion