The vulnerability causes the application to reuse a captured Time‑Based One‑Time Password (TOTP) within the acceptance window, allowing an attacker to re‑authenticate multiple times with a single code. This leads to unauthorized access if the attacker already owns valid user credentials, potentially exposing data and permitting privilege escalation. The weakness is classified as CWE‑294, an improper validation of time‑based one‑time passwords.

Any installation of the mayswind ezBookkeeping application running a version earlier than 2.0.0 is affected, regardless of deployment environment. Users who have not upgraded to the patched release are susceptible to the replay issue.

The CVSS score of 7.6 indicates a high severity, and although the EPSS score is not available, the lack of a KEV listing suggests that widespread exploitation is not yet confirmed. Attackers must first obtain stolen user credentials and then capture a valid TOTP in order to replay it within a roughly 90‑second window. Once those conditions are met, the attacker can re‑use the same code for multiple sessions without detection, making the risk significant for systems relying on TOTP for two‑factor authentication.