CVE-2026-94112 mayswind CVE debrief

Who should care

Defenders responsible for mayswind ezBookkeeping deployments should assess exposure and prioritize verification and remediation to prevent TOTP passcode replay attacks. This includes verifying and upgrading to version 2.0.0 or later, implementing additional authentication mechanisms, and monitoring authentication attempts for suspicious activity. Security teams and vulnerability management teams should also review compensating controls and track exceptions

Why it matters

CVE-2026-94112 is a high-severity vulnerability in mayswind ezBookkeeping that allows attackers to replay captured TOTP passcodes, potentially leading to unauthorized authentication and access. Defenders should prioritize verification and remediation to prevent TOTP passcode replay attacks.

• Attackers can reuse captured TOTP passcodes for approximately 90 seconds without detection
• Stolen credentials can be used to authenticate and authorize multiple attempts
• Defenders need to verify and upgrade to version 2.0.0 or later to prevent TOTP passcode replay attacks
• Additional authentication mechanisms and monitoring may be necessary to detect and prevent suspicious activity

Technical summary

mayswind ezBookkeeping before version 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90 seconds without detection. The vulnerability has a CVSS score of 7.6 and is classified as HIGH severity. Defenders should prioritize verifying and upgrading to version 2.0.0 or later of mayswind ezBookkeeping to prevent TOTP passcode replay attacks.

Defensive priority

Defenders should prioritize verifying and upgrading to version 2.0.0 or later of mayswind ezBookkeeping to prevent TOTP passcode replay attacks.

Recommended defensive actions

• Verify and upgrade to version 2.0.0 or later of mayswind ezBookkeeping
• Implement additional authentication mechanisms to prevent TOTP passcode replay attacks
• Monitor and analyze authentication attempts for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source references indicate that mayswind ezBookkeeping before version 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.