Description
Description
When an authenticated user sets up Recovery Codes, he has to validate a form listing the 12 Recovery Codes generated. The Recovery Codes displayed are sent back to the server when the user clicks the "Complete Setup" button though the generatedRecoveryAuthnCodes parameter. No checks on the values or number of the Recovery Codes sent by the user are performed by the application logic.
A user can therefore decide to send many more recovery codes (made of an alphabet of his choosing). If the user does not specify a parameter for the form's generatedRecoveryAuthnCodes parameter, a single Recovery Code equivalent to an empty string will be created.
Version
>= 23.0.4
Recommendations
Consider revising the application logic to check the validity of Recovery Codes sent by the user against the server generated ones.