CVE-2026-33667 describes an improper restriction of excessive authentication attempts (CWE-307) in OpenProject's two_factor_authentication module before version 17.3.0. The confirm_otp action lacks rate limiting and lockout mechanisms for 2FA OTP verification, and the brute_force_block_after_failed_logins setting only applies to password failures, not 2FA. Because the TOTP drift window allows multiple valid codes and attempts can be made at 5-10 per second, an attacker with a known password can brute-force the 6-digit OTP in about 11 hours, bypassing 2FA protections. Backup code verification is similarly affected. This vulnerability was addressed in OpenProject 17.3.0.

An attacker who has obtained a user's password can bypass the two-factor authentication mechanism by brute-forcing the 6-digit TOTP or backup codes due to the lack of rate limiting and lockout on the 2FA verification stage. This leads to a complete compromise of the affected account's confidentiality and integrity. There is no indication of availability impact. No known exploits in the wild have been reported.

Upgrade OpenProject to version 17.3.0 or later, where this vulnerability has been fixed by implementing proper rate limiting and lockout mechanisms on 2FA OTP verification. Until upgrading, be aware that accounts with known passwords are vulnerable to 2FA bypass via brute force. Patch status is not explicitly stated in vendor advisory content but the fix is included in version 17.3.0.