Open
Description
When validating TOTP with Skew > 0 and the current time window counter is 0,
the validation logic attempts to check previous time windows by subtracting
from counter 0, resulting in negative values. This is invalid as HOTP counters
must be non-negative integers.
Example:
- Current counter = 0
- Skew = 1
- Results in checking counters: [0, 1, -1] // -1 is invalid
Metadata
Metadata
Assignees
Labels
No labels