CVE-2022-25838: Laravel Fortify

High severity, CVSS 8.1. EPSS: 0.9% chance of exploitation in the next 30 days.

Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept.

Affected products

• Laravel Fortify: before 1.11.1 (fixed in 1.11.1)

Published 2022-02-24. Last modified 2026-06-17.