OpenProject versions earlier than 17.3.0 allow an attacker who knows a user’s password to validate the time‑based one‑time password used in two‑factor authentication because the confirm_otp action contains no rate limiting, lockout, or failed‑attempt tracking. With a default ±60‑second drift window that accepts roughly five valid six‑digit codes at a time, an adversary can attempt 5–10 OTP values per second and brute‑force the code in about eleven hours. The same lack of protection applies to backup code verification, allowing a full bypass of the second factor for compromised accounts. This flaw is a classic example of CWE‑307 – Authentication Bypass Through User Credential Manipulation – and, if exploited, undermines confidentiality, integrity, and availability by granting unauthorized users full access.

Vendor: OpenProject. Product: OpenProject project‑management software. Affected versions: All releases prior to 17.3.0, including the two_factor_authentication module’s confirm_otp action and the backup code verification path.

The CVSS base score of 7.4 indicates a high‑severity vulnerability. No EPSS data is available, and the flaw is not listed in the CISA KEV catalog, though it remains of significant concern in environments where passwords are weak or compromised. Exploitation requires a valid user password; once obtained, the absence of any rate limiting or lockout mechanism removes practical constraints on OTP attempts, making the risk substantial when password exposure is possible. The attack can be carried out over normal web traffic without special privileges or local access.