https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 15:01:26 +0000 https://cve.radiocsirt.org/vuln/cve-2026-78619 <p><strong>Affected:</strong> Punk-TOTP</p> <p>Punk::Plugin::TOTP versions before 0.05 for Perl accept another account&#39;s recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically.</p> <p>The helper searches the recovery model for the submitted code&#39;s digest alone, across every user&#39;s rows, so the ownership test that follows is the only thing binding a code to the account it was issued to. That test compares the row&#39;s user_id with the challenged user&#39;s id through Perl&#39;s integer coercion, and an identifier with no leading digits coerces to zero, so any two of them compare equal. User models keyed on a username, an email address or a UUID hit that case, and a numeric key compares as intended.</p> <p>The challenge route feeds a submitted value to the helper once TOTP verification fails, so an attacker who knows a victim&#39;s password and holds a recovery code of their own passes the victim&#39;s second factor.</p> <p><strong>Affected:</strong> Punk-TOTP</p> <p>Punk::Plugin::TOTP versions before 0.05 for Perl accept another account&#39;s recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically.</p> <p>The helper searches the recovery model for the submitted code&#39;s digest alone, across every user&#39;s rows, so the ownership test that follows is the only thing binding a code to the account it was issued to. That test compares the row&#39;s user_id with the challenged user&#39;s id through Perl&#39;s integer coercion, and an identifier with no leading digits coerces to zero, so any two of them compare equal. User models keyed on a username, an email address or a UUID hit that case, and a numeric key compares as intended.</p> <p>The challenge route feeds a submitted value to the helper once TOTP verification fails, so an attacker who knows a victim&#39;s password and holds a recovery code of their own passes the victim&#39;s second factor.</p> https://cve.radiocsirt.org/vuln/cve-2026-78619