CVE-2026-33667

OpenProject is an open-source project management application. In versions prior to 17.3.0, 2FA OTP verification in the confirm_otp action of the two_factor_authentication module has no rate limiting, lockout mechanism, or failed-attempt tracking. The existing brute_force_block_after_failed_logins setting only counts password login failures and does not apply to the 2FA verification stage, and neither the fail_login nor stage_failure methods increment any counter, lock the account, or add any delay. With the default TOTP drift window of ±60 seconds allowing approximately 5 valid codes at any time, an attacker who knows a user's password can brute-force the 6-digit TOTP code at roughly 5-10 attempts per second with an expected completion time of approximately 11 hours. The same vulnerability applies to backup code verification. This effectively allows complete 2FA bypass for any account where the password is known. This issue has been fixed in version 17.3.0.

• CWE-307

• https://github.com/opf/openproject/security/advisories/GHSA-234r-45m2-w6cvExploit, Mitigation, Vendor Advisory

Published

Apr 15, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33661Pay is an open-source payment SDK extension package for vari…7.5
• CVE-2026-33662OP-TEE is a Trusted Execution Environment (TEE) designed as …7.5
• CVE-2026-33663n8n is an open source workflow automation platform. Prior to…6.5
• CVE-2026-33664Kestra is an open-source, event-driven orchestration platfor…5.4
• CVE-2026-33665n8n is an open source workflow automation platform. Prior to…7.5
• CVE-2026-33666Zserio is a framework for serializing structured data with a…7.5
• CVE-2026-33668Vikunja is an open-source self-hosted task management platfo…8.1
• CVE-2026-33669SiYuan is a personal knowledge management system. Prior to v…7.5
• CVE-2026-3367The Lockme OAuth2 calendars integration plugin for WordPress…4.4
• CVE-2026-33670SiYuan is a personal knowledge management system. Prior to v…7.5
• CVE-2026-33671Picomatch is a glob matcher written JavaScript. Versions pri…7.5
• CVE-2026-33672Picomatch is a glob matcher written JavaScript. Versions pri…5.3