Logto’s TOTP verification logic incorrectly allowed a valid one‑time password to be used again within the RFC 6238 acceptance window because the otplib checker was stateless and did not store the time‑step counter. This flaw, identified as CWE‑294 (Improper Handling of Time‑Based One‑Time Password), permits an attacker who obtains a legitimate TOTP value while the user is authenticating to replay that value later in the same window, thereby bypassing multi‑factor authentication and gaining unauthorized access to the victim’s account.

Any deployment of logto‑io:logto running a version earlier than 1.41.0 is affected. The 1.41.0 release and newer versions contain a fix that enforces single‑use TOTP validation, eliminating the replayability issue.

The CVSS score of 6.4 reflects a moderate to high impact. An EPSS score of less than 1% indicates a low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to have the victim’s primary authentication factor and to intercept or capture a live TOTP value, which can be obtained through device compromise, phishing, or other manual collection methods. Once a code is captured, it can be replayed during the same validity window to satisfy MFA and impersonate the victim.