FileRise CVE-2026-103977

Exploitation requires that the attacker already possess a valid PRIMARY credential (username + password) for a target FileRise account that has TOTP two-factor authentication enabled - this is the hard precondition and the main limiting factor. Given that, the attacker abuses the pending-login TOTP handlers, which store failed verification counts only in $_SESSION rather than in a durable account-wide/source-wide budget: starting a new session (or changing client source address) restores the second-factor attempt allowance, enabling TOTP guessing beyond the intended five-attempt cap. Limiting factors beyond the credential requirement: success is still a probabilistic online guess against a time-limited rotating code, and deployments without TOTP enabled are unaffected by this specific bypass. Affected versions are all releases prior to 3.23.0.

This is a genuine but conditional priority, not a trivial high-CVSS inflation. The CWE-307 flaw lets a session/source reset bypass the intended five-attempt TOTP limit, defeating the rate-limiting that makes a 6-digit second factor brute-force-resistant. The provided CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.1) is internally consistent with the description: PR:L correctly reflects that the attacker must ALREADY hold the victim's valid primary credential - this is a 2FA-defeat flaw, not a pre-auth takeover, which meaningfully narrows the real-world attacker set. No EPSS score, CISA KEV listing, POC, or SSVC decision data were supplied, so automatability and exploitation-maturity signals cannot be weighed; absence of these is not evidence of safety but does mean there is no indication of active exploitation. The practical caveat: even with the limit removed, brute-forcing a TOTP code is a probabilistic online-guessing exercise against a rotating ~1,000,000-value space with ~30s time steps, so AC:L is arguably optimistic - real success still requires sustained guessing and the current time window, which may warrant AC:H. Priority should therefore be driven by exposure of compromised/weak primary passwords rather than by the 8.1 alone.

An attacker who has phished or reused a FileRise user's primary password is stopped at the TOTP prompt after five wrong guesses. They simply open a fresh session (or change client address), which the pending-login handlers treat as a new attempt budget, and resume online guessing of the 6-digit code until they land a valid one, gaining full access to the victim's file manager. No public exploit code was identified at time of analysis, but the bypass requires only repeating the normal login flow.