EUVD-2026-55222
GHSA-qm6j-5qpg-x2x4
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
AV:N and PR:N confirmed by unauthenticated network exploitation; AC:H reflects required concurrent timing to win race; C:H/I:H for full account takeover; A:N as availability is unaffected.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
3DescriptionCVE.org
A time-of-check/time-of-use (TOCTOU) race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on the account recovery flow, enabling brute-force attacks on 6-digit OTP codes. The verifyOTPSession function in pkg/auth/local.go reads and increments the attempt counter in separate non-atomic operations, allowing concurrent requests to observe the same attempt count below the threshold and proceed past the limit check before any update is committed.
AnalysisAI
Remote unauthenticated account takeover in fastschema through v0.15.1 is enabled by a TOCTOU race condition in the OTP-based account recovery flow. The verifyOTPSession function in pkg/auth/local.go reads and increments the attempt counter in separate non-atomic operations, allowing concurrent HTTP requests to race past the attempt limit before any counter update is committed. With no effective limit enforced on a 6-digit OTP (1,000,000 possible values), an attacker can brute-force valid codes; no public exploit is identified at time of analysis and this CVE is not in CISA KEV.
Technical ContextAI
fastschema is a Go-based headless CMS and content framework. The affected component is the local authentication module at pkg/auth/local.go, specifically the verifyOTPSession function implementing OTP validation during account recovery. The root cause is CWE-367 (Time-of-Check Time-of-Use Race Condition): the function performs a read of the current attempt counter and a subsequent write of the incremented value as two logically separate, non-atomic operations. In Go's goroutine model under concurrent request load, multiple goroutines can observe the pre-increment counter value simultaneously, all evaluate the limit check as passing, and each proceed to brute-force a distinct OTP candidate before any writes are committed. The CPE string cpe:2.3:a:fastschema:fastschema:*:*:*:*:*:*:*:* covers all fastschema releases through v0.15.1, with no version excluded.
RemediationAI
No vendor-released patch or confirmed fixed version is available from the provided data - the references point only to the upstream GitHub repository without a tagged patched release or security advisory. Operators should monitor https://github.com/fastschema/fastschema for a release that addresses the non-atomic counter operations. As a primary compensating control, apply rate limiting and concurrency throttling at the reverse proxy or WAF layer targeting the OTP verification endpoint, restricting the number of simultaneous requests per source IP to prevent the race from being won at meaningful scale - note this does not fully close the window on slow concurrent attacks. A stronger compensating measure is to disable the OTP-based account recovery feature entirely until a patch is available, at the cost of removing self-service account recovery for end users. Operators with access to the source should evaluate backporting a fix that replaces the read-increment sequence with an atomic compare-and-swap or database-level transaction to eliminate the TOCTOU window.
More in Fastschema
View allNULL pointer dereference in fastschema through v0.15.1 enables an unauthenticated remote attacker to crash the entire se
Stored XSS in fastschema through v0.15.1 permits any low-privileged authenticated user to store a script-bearing SVG fil
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today