Two-Factor Authentication Flaw in Vulnerability-Lookup by Vendor

CVE-2025-42615

What is CVE-2025-42615?

The Vulnerability-Lookup tool lacked effective tracking and limiting of failed One-Time Password (OTP) attempts during Two-Factor Authentication (2FA). This oversight allowed attackers with valid credentials to submit unlimited OTP codes without triggering account lockouts or alerts for administrators. Such a vulnerability significantly raises the risk of successful account takeovers, particularly if OTPs are short or predictable. The implemented patch now enforces a limit on failed OTP submissions, locking user accounts after five invalid attempts and enhancing oversight on suspicious 2FA activities.

References