A critical flaw in the jahlives openssl_encrypt library allows unauthenticated attackers to bypass TOTP rate limiting, facilitating brute-force attacks.

This vulnerability, categorized as CWE-770, involves the allocation of resources without proper throttling. The rate-limiting mechanism for TOTP authentication is stored in local memory, which is lost on restart and not shared across workers, allowing attackers to bypass brute-force protections.

By bypassing rate limiting, attackers can conduct high-speed brute-force attacks against TOTP-protected accounts. With a CVSS score of 9.8, this flaw allows for the compromise of user accounts, leading to unauthorized access to sensitive systems and data, and potential business disruption.

Immediate Action: Update jahlives openssl_encrypt to version 1.4.0 or later, which addresses the rate-limiting persistence and synchronization issues.

Proactive Monitoring: Monitor authentication logs for high volumes of failed TOTP attempts originating from single or distributed IP addresses.

Compensating Controls: Implement an external, centralized rate-limiting service, such as Redis or a WAF, to enforce authentication attempt limits consistently across all application instances.

Public Exploit Available: Unknown

The reliance on local memory for security-critical rate limiting is a significant design flaw that must be addressed. Organizations should update to version 1.4.0 immediately and, where possible, transition to a centralized, persistent rate-limiting architecture to ensure robust protection against brute-force attacks.