EUVD-2026-66120
GHSA-vwg8-cr9j-895f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
PR:L because first-factor authentication (existing account) is required; C:H and I:H because successful bypass enables full account takeover; no availability impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
2Description PRE-NVD
AnalysisAI
TOTP second-factor brute-force protection in Punk::Plugin::TOTP before 0.05 for Perl is defeated by replaying a saved session cookie, allowing an attacker with valid first-factor credentials to reset the TOTP failure counter indefinitely. Because Punk::Session stores the entire session state - including the TOTP attempt counter - in a client-side signed cookie when no server-side store is configured, an attacker can save the cookie before failures accumulate and replay it to restore a fresh counter, cycling this indefinitely within the pending_ttl window. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three conditions must simultaneously hold for exploitation: (1) the attacker must possess valid first-factor credentials for the target account, as the TOTP challenge is only reachable after password authentication succeeds; (2) the Punk application must use the default client-side signed-cookie session transport - specifically, the session keyword in the application must NOT declare a store pointing to a server-side Punk::Cache backend, because store-backed sessions hold the totp_pending record server-side where the client cannot manipulate it; (3) the attack must be executed within pending_ttl seconds (300 by default) of the replayed cookie's issuance timestamp, as expired pending records are rejected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is moderate but context-dependent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained a victim's first-factor credentials (username and password, e.g., via phishing or credential stuffing) initiates a login, is presented with the TOTP challenge, and captures the signed session cookie issued at that point. Before making four failed TOTP guesses (staying just below the default five-attempt limit), the attacker re-presents the saved cookie, restoring a fresh totp_pending record with a zeroed counter. … |
| Remediation | Upgrade to Punk-TOTP 0.05 or later, available on CPAN (https://metacpan.org/release/LNATION/Punk-TOTP-0.05/source/Changes). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems using Punk::Plugin::TOTP and prioritize for remediation; immediately apply server-side session state storage as a compensating control to prevent session cookie replay attacks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today