Skip to content
Threat Feed

Tag

Token Reusage

1 brief RSS
high advisory

eduMFA Token Reusage Vulnerability due to Incorrect InnoDB Snapshot Isolation

eduMFA versions prior to 2.9.1 are vulnerable to token reusage due to incorrect InnoDB snapshot isolation in MySQL and MariaDB versions prior to 11.6.2 (or newer with innodb_snapshot_isolation=off), affecting token types such as TOTP, HOTP, and likely WebAuthN, where tokens are intended for single use, requiring racing the transaction for exploitation.

MariaDB +1 vulnerability mfa token reusage
2r