What is the CVSS score of EUVD-2026-66119?

EUVD-2026-66119 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Punk::Plugin::TOTP are affected by EUVD-2026-66119?

Punk::Plugin::TOTP (Perl module) before version 0.05 contains a critical vulnerability that bypasses two-factor authentication when an attacker holds a victim's password.

How to fix or mitigate EUVD-2026-66119?

Within 24 hours: identify all systems using Punk::Plugin::TOTP and determine their current versions. Within 7 days: upgrade to version 0.05 or later (which appears to address this vulnerability per the technical description), or implement compensating controls if immediate patching is not feasible. Within 30 days: review and analyze authentication logs for any suspicious recovery code redemptions, force a TOTP re-enrollment for all users as a precautionary measure, and establish ongoing monitoring for recovery code activity anomalies.

Punk::Plugin::TOTP EUVD-2026-66119

| CVE-2026-78619 CRITICAL

Authentication Bypass by Primary Weakness (CWE-305)

2026-08-25

GHSA-m82c-83jf-3j4v

Information Disclosure

9.8

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.8 MEDIUM

AC:H and PR:L because the attacker needs their own recovery-enabled account plus the victim's password and a non-numeric key scheme; account takeover yields C:H/I:H, no availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 26, 2026 - 20:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 26, 2026 - 20:23 vuln.today

cvss_changed

CVSS changed

Aug 26, 2026 - 20:23 NVD

9.8 (CRITICAL)

Analysis Generated

Aug 25, 2026 - 22:16 vuln.today

CVE Published

Aug 25, 2026 - 21:52 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Two-factor authentication bypass in the Perl module Punk::Plugin::TOTP before 0.05 lets an attacker who already knows a victim's password clear the victim's TOTP challenge using a recovery code issued to the attacker's own account. The flaw stems from the recovery-code helper looking up codes by digest across all users and then binding ownership through a numeric comparison of user identifiers, which fails whenever accounts are keyed by username, email, or UUID. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Delivery

Acquire victim password out of band

Exploit

Fail primary TOTP at victim's challenge route

Execution

Submit attacker's recovery code, user_id coerces to zero

Persist

Ownership check passes, complete victim 2FA

Impact

Full victim account takeover

Access

Delivery

Acquire victim password out of band

Exploit

Fail primary TOTP at victim's challenge route

Execution

Submit attacker's recovery code, user_id coerces to zero

Persist

Ownership check passes, complete victim 2FA

Impact

Full victim account takeover

Vulnerability AssessmentAI

Exploitation	Exploitation requires three concrete prerequisites, all named in the description: (1) the attacker already knows the victim's account password, since the recovery code is only accepted after primary TOTP verification fails at the challenge route; (2) the attacker possesses a valid recovery code issued to an account they control; and (3) the target application keys its user models on a NON-numeric identifier - a username, email address, or UUID - because the bypass depends on Perl integer coercion collapsing such identifiers to zero so two of them compare equal. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) treats this as trivially exploitable and unauthenticated, but the description contradicts that: the attacker must already know the victim's password (first factor) AND hold a valid recovery code of their own (implying an attacker-controlled account), AND the target application must key user models on a non-numeric identifier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who has phished or reused a victim's password reaches the TOTP challenge, fails standard TOTP verification, then submits a recovery code from their own registered account. Because both accounts are keyed on non-numeric identifiers that coerce to zero, the ownership check passes and the attacker completes the victim's second factor, achieving full account takeover. …
Remediation	Upgrade to Punk::Plugin::TOTP 0.05 or later - Vendor-released patch: 0.05 (see the Changes file at https://metacpan.org/release/LNATION/Punk-TOTP-0.05/source/Changes and the oss-security advisory at https://seclists.org/oss-sec/2026/q3/574 / http://www.openwall.com/lists/oss-security/2026/08/25/6). … Detailed patch versions, workarounds, and compensating controls in full report.