MinorCritical vulnerability

CVE-2026-94112 (CVSS 7.6)

NVD · officialPublished Sep 20, 2026Risk 23/100

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90 seconds without detection.

Technical details

CVSS

7.6

AV:NetworkAC:HighPR:NoneUI:Passive

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source