A critical authentication vulnerability in OpenProject allows attackers with known user credentials to bypass two-factor authentication via brute-force, leading to unauthorized account access.

This vulnerability is an improper restriction of excessive authentication attempts (CWE-307) occurring within the two_factor_authentication module, where the 2FA verification stage lacks rate limiting or account lockout mechanisms for either TOTP or backup codes. The flaw allows an unauthenticated attacker who has obtained a user password to perform an offline-style brute-force attack against the 6-digit TOTP code.

The inability to restrict failed 2FA attempts exposes the organization to full account takeover for any user whose password has been compromised. Given the CVSS score of 7.4, this vulnerability represents a high risk to data confidentiality and integrity, as successful exploitation permits unauthorized access to sensitive project management data and administrative functions within the application.

Immediate Action: Upgrade OpenProject to version 17.3.0 or later immediately to implement the required rate limiting and account lockout protections for 2FA verification.

Proactive Monitoring: Monitor authentication logs for high volumes of failed 2FA verification attempts originating from single or multiple IP addresses, which may indicate an ongoing brute-force attempt.

Compensating Controls: If immediate patching is not feasible, implement strict IP-based rate limiting via a Web Application Firewall or reverse proxy to throttle requests to the 2FA verification endpoint.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability presents a significant security gap that renders existing 2FA protections ineffective against targeted credential-based attacks. Organizations should prioritize updating their OpenProject instances to version 17.3.0 as the primary method of remediation. Until the update is applied, administrators should review access logs for suspicious authentication patterns and enforce restrictive network access controls to limit the exposure of the authentication interface.