Waleed Hassan

**Name of the Vulnerable Software and Affected Versions** mayswind ezBookkeeping versions prior to 2.0.0 **Description** The software fails to invalidate Time-based One-Time Password (TOTP) passcodes after they have been used. This allows an attacker who has obtained stolen credentials to replay a captured passcode across multiple authorization attempts for approximately 90 seconds without being detected. **Recommendations** Update mayswind ezBookkeeping to version 2.0.0 or later.