Multi-Factor Authentication issue in Laravel Fortify

HOCH 8.1CVE-2022-25838 · GHSA-6w4v-qr4m-97gg · Published 24/02/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
laravel/fortify Packagist	`< 1.11.1`	`1.11.1`
fortify laravel	`< 1.11.1`	`1.11.1`

Description

Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept.

NVD description

Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.