Threats affecting pkg:github/ezBookkeeping

mayswind ezBookkeeping versions before 2.0.0 have a vulnerability where TOTP passcodes are not invalidated after use. This allows attackers who have captured a valid passcode to replay it within the acceptance window of approximately 90 seconds, enabling multiple unauthorized authentications without detection.