Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238…
Priority LOW 28CWE-254Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.
Summary
Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing a man-in-the-middle attack between the provider and verifier, or shoulder surfing, and replaying the OTP in the current time-step.
Why it matters now
EPSS 0.02058 81st percentileScored 2026-11-07
Fix Fixed devise-two-factor (RubyGems): 2.0.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | devise-two-factor (RubyGems) | before 2.0.0 | 2.0.0 | Patch available | GHSA-x489-jjwm-52g7 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- devise-two-factor (RubyGems) Vendor— Affected before 2.0.0 Fixed in 2.0.0 Patch available GHSA-x489-jjwm-52g7
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tinfoilsecurity:devise-two-factor:*:*:*:*:*:*:*:* | up to 1.1.0 | Vulnerable | Tinfoilsecurity |
- cpe:2.3:a:tinfoilsecurity:devise-two-factor:*:*:*:*:*:*:*:* Versions up to 1.1.0 Vulnerable ·Tinfoilsecurity
Remediation
- Fix · GHSA-x489-jjwm-52g7 devise-two-factor (RubyGems) Fixed in 2.0.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2015-7225
- 2026-10-03 Alias added: GHSA-x489-jjwm-52g7
References
Advisory 5
Other 6
- [oss-security] 20150917 Re: CVE Request: TOTP Replay Attack in Ruby library
- [oss-sercurity] 20150620 CVE Request: MITM & Shoulder-surfing vuln in Ruby OTP/HOTP/TOTP library "ROPT"
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/devise-two-factor/CVE-2015-7225.yml
- https://github.com/tinfoil/devise-two-factor
- https://web.archive.org/web/20210122192452/https://www.securityfocus.com/bid/76789
- http://www.openwall.com/lists/oss-security/2015/09/06/2
More Tinfoilsecurity Devise-two-factor vulnerabilities
- TI-2024-08162 Insufficient Default OTP Shared Secret Length CVSS 4.0MEDIUM 6.0
- TI-2021-19191 As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor… CVSS 3.1MEDIUM 5.3
Sources
- CVE-2015-7225 · CVE Program
- CVE-2015-7225 · NVD
- FIRST EPSS
- GHSA-x489-jjwm-52g7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences