Really Simple SSL exposed a two-factor reset path on the user profile form that only checked a nonce, not whether the user was permitted to turn their second factor off. A user who was required to use two-factor authentication could submit a crafted profile update that deleted their own 2FA metadata, resetting the mandatory-2FA grace period and deferring enforcement indefinitely. The fix removes the permissive reset path and refuses to delete 2FA metadata for any user the site forces to use two-factor authentication.
This vulnerability affects the following application versions:
- Really Simple SSL 9.0.0
- Really Simple SSL 9.0.2
- Really Simple SSL 9.1.0
- Really Simple SSL 9.1.1
- Really Simple SSL 9.1.1.1
- Really Simple SSL 9.1.2
- Really Simple SSL 9.1.3
- Really Simple SSL 9.1.4
- Really Simple SSL 9.2.0
- Really Simple SSL 9.3.1
- Really Simple SSL 9.3.2
- Really Simple SSL 9.3.2.1
- Really Simple SSL 9.3.3
- Really Simple SSL 9.3.5
- Really Simple SSL 9.4.0
- Really Simple SSL 9.4.1
- Really Simple SSL 9.4.2
- Really Simple SSL 9.4.3
- Really Simple SSL 9.5.0
- Really Simple SSL 9.5.0.1
- Really Simple SSL 9.5.0.2
- Really Simple SSL 9.5.1
- Really Simple SSL 9.5.2
- Really Simple SSL 9.5.2.2
- Really Simple SSL 9.5.2.3
- Really Simple SSL 9.5.3
- Really Simple SSL 9.5.3.1
- Really Simple SSL 9.5.3.2
- Really Simple SSL 9.5.4
- Really Simple SSL 9.5.5
- Really Simple SSL 9.5.6
- Really Simple SSL 9.5.7
- Really Simple SSL 9.5.8
- Really Simple SSL 9.5.9
- Really Simple SSL 9.5.10
- Really Simple SSL 9.5.10.1
- Really Simple SSL 9.6.0
- Really Simple SSL 9.6.1
- Really Simple SSL 9.7.0
- Really Simple SSL 9.8.0
- Really Simple SSL 9.8.1