CVE-2022-45168: Liveboxcloud Vdesk

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication can occur under the /login/backup_code endpoint and the /api/v1/vdeskintegration/createbackupcodes endpoint, because the application allows a user to generate or regenerate the backup codes before checking the TOTP.

Affected products

• Liveboxcloud Vdesk: up to and including 018

Published 2024-06-10. Last modified 2026-06-17.