CVE-2026-94112
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90 seconds without detection.
Risk Assessment
The risk includes unauthorized access to user accounts even when two-factor authentication is enabled, which could lead to financial data compromise.
Recommendation
It is recommended to upgrade ezBookkeeping to version 2.0.0 or later, which invalidates TOTP codes after use, and to consider additional security mechanisms.
Other vulnerabilities in ezBookkeeping
See all- CVE-2026-86041Medium
ezBookkeeping constructs its Gin router with gin.New() without configuring SetTrustedProxies, causing c.ClientIP() to trust a spoofed X-Forwarded-For value. An unauthenticated remote attacker can supply an allowlisted address to bypass the mcp_allowed_remote_ips or api_token_allowed_remote_ips gate. A valid MCP or API token is still required for protected actions, but the spoofed value is stored in Transaction.CreatedIp and request logs, attributing activity to the trusted host.
- CVE-2026-105131Medium
ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session token via /api/v1/tokens/refresh.json. Because TokenRefreshHandler never checks token type, attackers can exchange short-lived or IP-restricted API tokens for 30-day normal session tokens that bypass API token expiry and allowlists.
Original NVD description (English source)
mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90 seconds without detection.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS