CVE-2024-5657

CraftCMS Plugin - Two-Factor Authentication - Password Hash Disclosure

The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.

Affected

Born05 · CraftCMS Plugin - Two-Factor Authentication

CVSS v3.1 NVD

8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 CNA

3.7 LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.83% chance of exploitation in the next 30 days, 57th percentile

Published

2024-06-06

Updated

2025-09-03

Proof-of-concept exploits (2)

• http://www.openwall.com/lists/oss-security/2024/06/06/1
• sbaresearch/advisories/tree/public/2024/SBA-ADV-20240202-01_CraftCMS_Plugin_Two-Factor_Au…29★ · 2026-07-30

Security advisories

• advisories/GHSA-3p4x-grpm-xw58
• born05/craft-twofactorauthentication/releases/tag/3.3.4
• https://plugins.craftcms.com/two-factor-authentication?craft4

References

• CVE Record
• NVD entry

Related

• CVE-2015-5243
• CVE-2015-8299
• CVE-2018-13982
• CVE-2018-17532
• CVE-2018-17533
• CVE-2018-17534