Threat database

ezBookkeeping versions 1.2.0 up to but not including 2.0.1 contain a privilege escalation vulnerability. Attackers with an API token can exploit the token refresh endpoint to obtain a full session token without proper authorization checks. This allows bypassing API token expiry and allowlists, potentially extending access privileges for 30 days.

mayswind ezBookkeeping versions before 2.0.0 have a vulnerability where TOTP passcodes are not invalidated after use. This allows attackers who have captured a valid passcode to replay it within the acceptance window of approximately 90 seconds, enabling multiple unauthorized authentications without detection.