As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor…
Priority LOW 26CWE-254Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Why it matters now
EPSS 0.00884 59th percentileScored 2026-11-07
Fix Fixed devise-two-factor (Tinfoil): 4.0.2devise-two-factor (RubyGems): 4.0.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Tinfoil | devise-two-factor | before 4.0.2 | 4.0.2 | Patch available | CNA |
| — | devise-two-factor (RubyGems) | before 4.0.2 | 4.0.2 | Patch available | GHSA-jm35-h8q2-73mp |
- devise-two-factor VendorTinfoil Affected before 4.0.2 Fixed in 4.0.2 Patch available CNA
- devise-two-factor (RubyGems) Vendor— Affected before 4.0.2 Fixed in 4.0.2 Patch available GHSA-jm35-h8q2-73mp
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tinfoilsecurity:devise-two-factor:*:*:*:*:*:*:*:* | before 4.0.2 | Vulnerable | Tinfoilsecurity |
- cpe:2.3:a:tinfoilsecurity:devise-two-factor:*:*:*:*:*:*:*:* Versions before 4.0.2 Vulnerable ·Tinfoilsecurity
Remediation
- Fix · CNA devise-two-factor (Tinfoil) Fixed in 4.0.2
- Fix · GHSA-jm35-h8q2-73mp devise-two-factor (RubyGems) Fixed in 4.0.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-43177
- 2026-10-03 Alias added: GHSA-jm35-h8q2-73mp
References
Advisory 2
More Tinfoilsecurity Devise-two-factor vulnerabilities
- TI-2024-08162 Insufficient Default OTP Shared Secret Length CVSS 4.0MEDIUM 6.0
- TI-2015-05998 Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238… CVSS 3.0MEDIUM 5.3
Sources
- CVE-2021-43177 · CVE Program
- CVE-2021-43177 · NVD
- FIRST EPSS
- GHSA-jm35-h8q2-73mp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences