GHSA-6x93-h9g3-9phr

otp-generator before v3.0.0 insecurely generates random one-time passwords

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-23451

Packages

Ecosystem	Package	Affected	Fixed in
npm	otp-generator	< 3.0.0	3.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-23451 advisory
https://github.com/Maheshkumar-Kakade/otp-generator/issues/12 web
https://github.com/Maheshkumar-Kakade/otp-generator/commit/b27de1ce439ae7f533cec26677e9698671275b70 web
https://github.com/Maheshkumar-Kakade/otp-generator package
https://security.snyk.io/vuln/SNYK-JS-OTPGENERATOR-1655480 web