CVE-2022-25838: Multi-Factor Authentication issue in Laravel Fortify

February 25, 2022 (updated February 26, 2022)

Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the “OT” part of the “TOTP” concept.

References

github.com/advisories/GHSA-6w4v-qr4m-97gg
github.com/laravel/fortify/issues/201
github.com/laravel/fortify/pull/357
github.com/laravel/fortify/pull/358
nvd.nist.gov/vuln/detail/CVE-2022-25838

Code Behaviors & Features

Detect and mitigate CVE-2022-25838 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →