OpenProject 2FA Bypass: Brute-Force Vulnerability Uncovered

A significant vulnerability, tracked as CVE-2026-33667, has been identified in OpenProject, an open-source project management application. According to the National Vulnerability Database, versions prior to 17.3.0 are susceptible to a 2FA bypass due to a critical oversight in the two-factor authentication module. Specifically, the confirm_otp action lacks any rate limiting, lockout mechanisms, or failed-attempt tracking for OTP verification.

The National Vulnerability Database highlighted that OpenProject’s existing brute-force blocking only applies to password login failures, completely ignoring the 2FA verification stage. This means an attacker who already possesses a user’s password can brute-force the 6-digit TOTP code. With a default TOTP drift window of ±60 seconds, allowing for approximately five valid codes at any given time, a determined attacker could theoretically attempt 5-10 codes per second, potentially cracking the 2FA in about 11 hours. This issue also extends to backup code verification, effectively neutralizing the protection 2FA is meant to provide. The vulnerability carries a CVSS score of 7.4 (HIGH) and has been patched in version 17.3.0.