What is the CVSS score of CVE-2026-32729?

CVE-2026-32729 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Runtipi are affected by CVE-2026-32729?

CVE-2026-32729 is a high-severity authentication bypass vulnerability in Runtipi that allows attackers with stolen credentials to circumvent two-factor authentication within 33 minutes through TOTP…

How to fix or mitigate CVE-2026-32729?

Within 24 hours: Identify all Runtipi instances in your environment and document current versions. Within 7 days: Upgrade all Runtipi deployments to version 4.8.1 or later; conduct credential audit and reset passwords for all accounts, particularly administrative users. Within 30 days: Review access logs for suspicious authentication attempts; implement multi-factor authentication through alternative mechanisms if available; establish inventory management for third-party orchestration tools.

Runtipi CVE-2026-32729

HIGH

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-03-13 GitHub_M

Authentication Bypass Runtipi

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 13, 2026 - 22:01 vuln.today

CVE Published

Mar 13, 2026 - 21:41 nvd

HIGH 8.1

DescriptionGitHub Advisory

Runtipi is a personal homeserver orchestrator. Prior to 4.8.1, The Runtipi /api/auth/verify-totp endpoint does not enforce any rate limiting, attempt counting, or account lockout mechanism. An attacker who has obtained a user's valid credentials (via phishing, credential stuffing, or data breach) can brute-force the 6-digit TOTP code to completely bypass two-factor authentication. The TOTP verification session persists for 24 hours (default cache TTL), providing an excessive window during which the full 1,000,000-code keyspace (000000-999999) can be exhausted. At practical request rates (~500 req/s), the attack completes in approximately 33 minutes in the worst case. This vulnerability is fixed in 4.8.1.

AnalysisAI

Critical authentication bypass vulnerability in Runtipi (versions prior to 4.8.1), a personal homeserver orchestrator, where attackers with stolen credentials can brute-force TOTP codes due to missing rate limiting. The vulnerability allows complete bypass of two-factor authentication in approximately 33 minutes, effectively compromising account security. While not currently in CISA KEV or showing high EPSS scores, the vulnerability has a CVSS 8.1 rating and a patch is available in version 4.8.1.

Technical ContextAI

Runtipi (CPE: cpe:2.3:a:runtipi:runtipi:*:*:*:*:*:*:*:*) implements TOTP-based two-factor authentication through its /api/auth/verify-totp endpoint. The vulnerability stems from CWE-307 (Improper Restriction of Excessive Authentication Attempts), where the endpoint lacks fundamental security controls including rate limiting, attempt counting, and account lockout mechanisms. The 24-hour session persistence combined with the finite 6-digit TOTP keyspace (1,000,000 combinations from 000000-999999) creates an exploitable window for exhaustive brute-force attacks at approximately 500 requests per second.

RemediationAI

The primary remediation is to upgrade Runtipi to version 4.8.1 or later, which implements proper rate limiting and authentication controls. The vendor advisory is available at https://github.com/runtipi/runtipi/security/advisories/GHSA-v6gf-frxm-567w. As an immediate mitigation, organizations should strengthen credential security, implement network-level rate limiting if possible, and monitor for suspicious authentication patterns. Consider implementing additional authentication factors beyond TOTP until patching is complete.