CVE-2026-33667 opf CVE debrief

Who should care

Defenders responsible for OpenProject deployments should assess their exposure and prioritize upgrading to version 17.3.0 or later. They should also review their current 2FA implementation and consider additional security measures such as IP restrictions or monitoring for suspicious login attempts.

Why it matters

The OpenProject 2FA bypass vulnerability allows an attacker with a user's password to brute-force the 2FA code, effectively bypassing 2FA security. Defenders should prioritize upgrading to OpenProject version 17.3.0 or later and review their 2FA implementation.

• An attacker who knows a user's password can bypass 2FA and gain unauthorized access to the account.
• The 2FA bypass vulnerability allows for potential lateral movement within the OpenProject application.
• Defenders need to verify their OpenProject version and assess exposure to this vulnerability.
• Remediation priority is high due to the potential for unauthorized access.

Technical summary

The OpenProject application's two-factor authentication (2FA) process is vulnerable to bypass. In versions prior to 17.3.0, the 2FA OTP verification in the confirm_otp action of the two_factor_authentication module has no rate limiting, lockout mechanism, or failed-attempt tracking. This allows an attacker who knows a user's password to brute-force the 6-digit TOTP code at a rate of approximately 5-10 attempts per second, with an expected completion time of around 11 hours. The same vulnerability applies to backup code verification.

Defensive priority

Defenders should prioritize upgrading to OpenProject version 17.3.0 or later to address the 2FA bypass vulnerability. They should also review their current 2FA implementation and consider additional security measures such as IP restrictions or monitoring for suspicious login attempts.

Recommended defensive actions

• Upgrade to OpenProject version 17.3.0 or later
• Review and enhance 2FA implementation
• Monitor for suspicious login attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE description and source metadata indicate that OpenProject versions prior to 17.3.0 are vulnerable to 2FA bypass. The NVD entry is currently Analyzed. Defenders should verify OpenProject version and assess exposure to this vulnerability with limited source detail. Evidence limits suggest verification tasks are needed to confirm affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.