EUVD-2026-55222
GHSA-qm6j-5qpg-x2x4
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
AV:N and PR:N confirmed by unauthenticated network exploitation; AC:H reflects required concurrent timing to win race; C:H/I:H for full account takeover; A:N as availability is unaffected.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
3DescriptionCVE.org
A time-of-check/time-of-use (TOCTOU) race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on the account recovery flow, enabling brute-force attacks on 6-digit OTP codes. The verifyOTPSession function in pkg/auth/local.go reads and increments the attempt counter in separate non-atomic operations, allowing concurrent requests to observe the same attempt count below the threshold and proceed past the limit check before any update is committed.
AnalysisAI
Remote unauthenticated account takeover in fastschema through v0.15.1 is enabled by a TOCTOU race condition in the OTP-based account recovery flow. The verifyOTPSession function in pkg/auth/local.go reads and increments the attempt counter in separate non-atomic operations, allowing concurrent HTTP requests to race past the attempt limit before any counter update is committed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target deployment runs fastschema v0.15.1 or earlier with the OTP-based account recovery flow enabled and exposed over the network - if this feature is disabled or the recovery endpoint is blocked, the attack surface does not exist. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.4 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N captures the essential tension in this vulnerability: the outcome is severe (full account compromise via C:H/I:H) but exploitation is not trivial, as AC:H reflects the requirement to time and coordinate a high volume of concurrent requests to win the race. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or confirmed fixed version is available from the provided data - the references point only to the upstream GitHub repository without a tagged patched release or security advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all fastschema deployments (particularly internet-facing instances), confirm versions ≤0.15.1, and assess exposure by reviewing OTP recovery usage logs for suspicious patterns; notify the security team and affected business units of the control gap. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fastschema
View allNULL pointer dereference in fastschema through v0.15.1 enables an unauthenticated remote attacker to crash the entire se
Stored XSS in fastschema through v0.15.1 permits any low-privileged authenticated user to store a script-bearing SVG fil
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today