FileRise EUVD-2026-101684

Exploitation requires the attacker to already possess the target account's valid primary credential (username and password) AND to capture a TOTP code that the victim is using during a genuine login, then replay it from a separate pending-login session before that time step's window closes. The core precondition is that FileRise (prior to 3.23.0) validates the TOTP code against the time window without recording that the same account/time-step already succeeded, so no TOTP-specific setting must be enabled - the flaw affects standard TOTP-protected accounts. Limiting factors: it does not disclose the password or TOTP code (so credentials must be obtained separately), it needs a concurrent/near-simultaneous victim login to produce a capturable code (UI:R), and the replay must land inside the TOTP acceptance window (AC:H), making it a narrow, targeted race rather than a broad remote attack.

This is a genuine but conditional, moderate-severity issue rather than a top-priority emergency. The published CVSS of 6.4 (AV:N/AC:H/PR:L/UI:R) is internally consistent with the description: it is network-reachable but gated by high attack complexity and two hard preconditions - the attacker must already hold the victim's valid primary credential (PR:L, authenticated) and must capture a legitimate TOTP code within its short validity window (UI:R, requiring a concurrent victim login). No EPSS score, KEV listing, or public POC was provided in the input, so there is no signal of active or probable near-term exploitation; per available data this is 'no public exploit identified at time of analysis.' The signals are not conflicting - they consistently point to a targeted, not opportunistic or wormable, attack. The CVSS claims C:H/I:H/A:N, meaning full read/write to the victim's files but no availability impact, which matches a single-factor-bypass-into-account-takeover outcome. Net: a real second-factor weakness worth patching on schedule, but the combined requirement of stolen credentials plus live TOTP capture materially limits real-world risk below what a 'network/high-impact' headline might suggest.

An attacker who has already phished or otherwise stolen a FileRise user's username and password sniffs or observes the TOTP code the victim enters during a legitimate login, then - from a second pending-login session held open with the stolen password - replays that same still-valid code before its time step expires, completing authentication a second time and taking over the account. No public exploit code was identified; the attack hinges on the high-complexity timing race (AC:H) and a concurrent victim login (UI:R), so it is realistic only against a specifically targeted account.