Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2024-8796

16
FAUCET Score

CVE-2024-8796 affects Devise-Two-Factor versions 2.2.0 through 5.x, where the default configuration generates TOTP shared secrets that are 120 bits, falling short of the 128-bit minimum specified by RFC 4226. This vulnerability, rated Medium with a CVSS score of 5.3, could allow an attacker to more easily guess the shorter shared secret and generate valid multi-factor authentication codes, leading to unauthorized access. The attack complexity is high, and it requires low privileges, but no user interaction. Currently, there is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
>= 4.0.0, < 6.0.0CPE matchmatch criteria
cpe:2.3:a:tinfoilsecurity:devise-two-factor:*:*:*:*:*:*:*:*
1.0.0CPE matchmatch criteria
cpe:2.3:a:tinfoilsecurity:devise-two-factor:1.0.0:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 4.0

6.0MEDIUM

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
PRESENT
Privileges Required
LOW
User Interaction
NONE
VS Confidentiality
HIGH
VS Integrity
NONE
VS Availability
NONE
SS Confidentiality
NONE
SS Integrity
NONE
SS Availability
NONE
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
0.64%
Probability of exploitation in next 30 days
EPSS Percentile
47.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
This CVE's current EPSS score of 0.0064 is in the 36th percentile among its peer group of 1,425 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

rubygemspatch availablevia ghsa
Product: devise-two-factorFixed in: 6.0.0
github_advisoryworkaround availablevia nvd_reference
View patch

Vendor Advisories (1)

rubygemsGHSA-qjxf-mc72-wjr2medium

Devise-Two-Factor Authentication Uses Insufficient Default OTP Shared Secret Length

Sep 17, 2024

References

github.com / devise-two-factor/devise-two-factor/security/advisories/GHSA-qjxf-mc72-wjr2
MitigationVendor Advisory