CVE-2026-33667

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33667", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-23T15:23:42.220Z", "datePublished": "2026-04-15T18:43:14.130Z", "dateUpdated": "2026-04-15T20:00:14.503Z"}, "containers": {"cna": {"title": "OpenProject: 2FA OTP Verification Missing Rate Limiting", "problemTypes": [{"descriptions": [{"cweId": "CWE-307", "lang": "en", "description": "CWE-307: Improper Restriction of Excessive Authentication Attempts", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/opf/openproject/security/advisories/GHSA-234r-45m2-w6cv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/opf/openproject/security/advisories/GHSA-234r-45m2-w6cv"}], "affected": [{"vendor": "opf", "product": "openproject", "versions": [{"version": "< 17.3.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-15T18:43:14.130Z"}, "descriptions": [{"lang": "en", "value": "OpenProject is an open-source project management application. In versions prior to 17.3.0, 2FA OTP verification in the confirm_otp action of the two_factor_authentication module has no rate limiting, lockout mechanism, or failed-attempt tracking. The existing brute_force_block_after_failed_logins setting only counts password login failures and does not apply to the 2FA verification stage, and neither the fail_login nor stage_failure methods increment any counter, lock the account, or add any delay. With the default TOTP drift window of \u00b160 seconds allowing approximately 5 valid codes at any time, an attacker who knows a user's password can brute-force the 6-digit TOTP code at roughly 5-10 attempts per second with an expected completion time of approximately 11 hours. The same vulnerability applies to backup code verification. This effectively allows complete 2FA bypass for any account where the password is known. This issue has been fixed in version 17.3.0."}], "source": {"advisory": "GHSA-234r-45m2-w6cv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-15T19:59:53.990177Z", "id": "CVE-2026-33667", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T20:00:14.503Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33667", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-15T19:59:53.990177Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T20:00:04.898Z"}}], "cna": {"title": "OpenProject: 2FA OTP Verification Missing Rate Limiting", "source": {"advisory": "GHSA-234r-45m2-w6cv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "opf", "product": "openproject", "versions": [{"status": "affected", "version": "< 17.3.0"}]}], "references": [{"url": "https://github.com/opf/openproject/security/advisories/GHSA-234r-45m2-w6cv", "name": "https://github.com/opf/openproject/security/advisories/GHSA-234r-45m2-w6cv", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source project management application. In versions prior to 17.3.0, 2FA OTP verification in the confirm_otp action of the two_factor_authentication module has no rate limiting, lockout mechanism, or failed-attempt tracking. The existing brute_force_block_after_failed_logins setting only counts password login failures and does not apply to the 2FA verification stage, and neither the fail_login nor stage_failure methods increment any counter, lock the account, or add any delay. With the default TOTP drift window of \u00b160 seconds allowing approximately 5 valid codes at any time, an attacker who knows a user's password can brute-force the 6-digit TOTP code at roughly 5-10 attempts per second with an expected completion time of approximately 11 hours. The same vulnerability applies to backup code verification. This effectively allows complete 2FA bypass for any account where the password is known. This issue has been fixed in version 17.3.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-307", "description": "CWE-307: Improper Restriction of Excessive Authentication Attempts"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-15T18:43:14.130Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33667", "state": "PUBLISHED", "dateUpdated": "2026-04-15T20:00:14.503Z", "dateReserved": "2026-03-23T15:23:42.220Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-15T18:43:14.130Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openproject", "vendor": "opf", "versions": [{"status": "affected", "version": "< 17.3.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*", "matchCriteriaId": "9C9F05E3-C32E-4932-BFBB-8F3E2D9D4292", "versionEndExcluding": "17.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source project management application. In versions prior to 17.3.0, 2FA OTP verification in the confirm_otp action of the two_factor_authentication module has no rate limiting, lockout mechanism, or failed-attempt tracking. The existing brute_force_block_after_failed_logins setting only counts password login failures and does not apply to the 2FA verification stage, and neither the fail_login nor stage_failure methods increment any counter, lock the account, or add any delay. With the default TOTP drift window of \u00b160 seconds allowing approximately 5 valid codes at any time, an attacker who knows a user's password can brute-force the 6-digit TOTP code at roughly 5-10 attempts per second with an expected completion time of approximately 11 hours. The same vulnerability applies to backup code verification. This effectively allows complete 2FA bypass for any account where the password is known. This issue has been fixed in version 17.3.0."}, {"lang": "es", "value": "OpenProject es una aplicaci\u00f3n de gesti\u00f3n de proyectos de c\u00f3digo abierto. En versiones anteriores a la 17.3.0, la verificaci\u00f3n OTP de 2FA en la acci\u00f3n confirm_otp del m\u00f3dulo two_factor_authentication no tiene limitaci\u00f3n de velocidad, mecanismo de bloqueo ni seguimiento de intentos fallidos. La configuraci\u00f3n existente brute_force_block_after_failed_logins solo cuenta los fallos de inicio de sesi\u00f3n por contrase\u00f1a y no se aplica a la etapa de verificaci\u00f3n de 2FA, y ni los m\u00e9todos fail_login ni stage_failure incrementan ning\u00fan contador, bloquean la cuenta o a\u00f1aden ning\u00fan retraso. Con la ventana de deriva TOTP predeterminada de \u00b160 segundos que permite aproximadamente 5 c\u00f3digos v\u00e1lidos en cualquier momento, un atacante que conoce la contrase\u00f1a de un usuario puede forzar por fuerza bruta el c\u00f3digo TOTP de 6 d\u00edgitos a aproximadamente 5-10 intentos por segundo con un tiempo de finalizaci\u00f3n esperado de aproximadamente 11 horas. La misma vulnerabilidad se aplica a la verificaci\u00f3n de c\u00f3digos de respaldo. Esto permite efectivamente la omisi\u00f3n completa de 2FA para cualquier cuenta donde la contrase\u00f1a sea conocida. Este problema ha sido solucionado en la versi\u00f3n 17.3.0."}], "id": "CVE-2026-33667", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33667", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-15T19:59:53.990177Z", "version": "2.0.3"}}]}, "published": "2026-04-15T19:16:35.603", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/opf/openproject/security/advisories/GHSA-234r-45m2-w6cv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-307"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,17.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "openproject", "source": "cna", "vendor": "opf"}, "product": "openproject", "vendor": "opf"}], "analysis": {"en": {"generated_at": "2026-04-16T09:10:05.256935+00:00", "value": {"mitigation_remediation": ["Upgrade to OpenProject 17.3.0 or later to apply the vendor\u2011provided fix for OTP verification rate limiting.", "If an upgrade cannot be performed immediately, temporarily disable two\u2011factor authentication for all affected accounts until the patch is applied, preventing the bypass from being effective.", "Enforce a robust password policy and consider deploying hardware or dual\u2011factor tokens to reduce the likelihood that an attacker can obtain valid credentials in the first place."], "summary": {"action": "Immediate Patch", "impact": "Authentication Bypass via OTP Brute Force"}, "threat_synthesis": {"affected_systems": "Vendor: OpenProject.\nProduct: OpenProject project\u2011management software.\nAffected versions: All releases prior to 17.3.0, including the two_factor_authentication module\u2019s confirm_otp action and the backup code verification path.", "description_and_impact": "OpenProject versions earlier than 17.3.0 allow an attacker who knows a user\u2019s password to validate the time\u2011based one\u2011time password used in two\u2011factor authentication because the confirm_otp action contains no rate limiting, lockout, or failed\u2011attempt tracking. With a default \u00b160\u2011second drift window that accepts roughly five valid six\u2011digit codes at a time, an adversary can attempt 5\u201310 OTP values per second and brute\u2011force the code in about eleven hours. The same lack of protection applies to backup code verification, allowing a full bypass of the second factor for compromised accounts. This flaw is a classic example of CWE\u2011307 \u2013 Authentication Bypass Through User Credential Manipulation \u2013 and, if exploited, undermines confidentiality, integrity, and availability by granting unauthorized users full access.", "risk_and_exploitability": "The CVSS base score of 7.4 indicates a high\u2011severity vulnerability. No EPSS data is available, and the flaw is not listed in the CISA KEV catalog, though it remains of significant concern in environments where passwords are weak or compromised. Exploitation requires a valid user password; once obtained, the absence of any rate limiting or lockout mechanism removes practical constraints on OTP attempts, making the risk substantial when password exposure is possible. The attack can be carried out over normal web traffic without special privileges or local access."}}}}, "created": "2026-04-15T21:15:13.493029+00:00", "updated": "2026-04-16T09:15:30.987035+00:00", "vendors": ["opf", "opf$PRODUCT$openproject"]}