Project: 
TFA Basic plugins
Date: 
2018-June-27
Security risk: 
Less critical 9 ∕ 25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Default
Vulnerability: 
Insecure Randomness
Description: 

The TFA Basic module enables you to use Two Factor Authentication via a variety of plugins including TOTP and one-time codes delivered via email or sms.

The module doesn't use a strong source of randomness, creating weak and predictable one-time login codes that are then delivered using SMS. This weakness does not affect the more common TOTP second factor.

This vulnerability is mitigated by the fact that the site must be configured to use SMS to deliver one-time login codes which is an uncommon configuration.

Solution: 

Also see the TFA Basic plugins project page.

Reported By: 
Fixed By: 
Coordinated By: