https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-10T01:30:47.533305+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2024-8796 CVE-2024-8796 — Insufficient Default OTP Shared Secret Length 2026-10-10T01:30:47.867933+00:00

Affected: devise-two-factor

Under the default configuration, Devise-Two-Factor versions >= 2.2.0 & < 6.0.0 generate TOTP shared secrets that are 120 bits instead of the 128-bit minimum defined by RFC 4226. Using a shared secret shorter than the minimum to generate a multi-factor authentication code could make it easier for an attacker to guess the shared secret and generate valid TOTP codes.

 https://vulnerability.circl.lu/vuln/usn-7050-1 USN-7050-1 — ruby-devise-two-factor vulnerabilities 2026-10-10T01:30:47.868058+00:00

Affected: Ubuntu:Pro:20.04:LTS: ruby-devise-two-factor, Ubuntu:Pro:22.04:LTS: ruby-devise-two-factor

Benoit Côté-Jodoin and Michael Nipper discovered that Devise-Two-Factor incorrectly handled one-time password validation. An attacker could possibly use this issue to intercept and re-use a one-time password. (CVE-2021-43177)

Garrett Rappaport discovered that Devise-Two-Factor incorrectly handled generating multi-factor authentication codes. An attacker could possibly use this issue to generate valid multi-factor authentication codes. (CVE-2024-8796)