Vulnerability-Lookup

CVE-2026-78619 (GCVE-0-2026-78619)

Vulnerability from cvelistv5 – Published: 2026-08-25 21:21 – Updated: 2026-08-25 23:07

Title

Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically

Summary

Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically. The helper searches the recovery model for the submitted code's digest alone, across every user's rows, so the ownership test that follows is the only thing binding a code to the account it was issued to. That test compares the row's user_id with the challenged user's id through Perl's integer coercion, and an identifier with no leading digits coerces to zero, so any two of them compare equal. User models keyed on a username, an email address or a UUID hit that case, and a numeric key compares as intended. The challenge route feeds a submitted value to the helper once TOTP verification fails, so an attacker who knows a victim's password and holds a recovery code of their own passes the victim's second factor.

Severity

No CVSS data available.

CWE

CWE-305 - Authentication Bypass by Primary Weakness
CWE-1025 - Comparison Using Wrong Factors

Assigner

CPANSec redhat root

References

4 references

URL	Tags
https://metacpan.org/release/LNATION/Punk-TOTP-0.…	technical-description
https://metacpan.org/release/LNATION/Punk-TOTP-0.…	technical-description
https://metacpan.org/release/LNATION/Punk-TOTP-0.…	release-notes
http://www.openwall.com/lists/oss-security/2026/08/25/6

Impacted products

1 product

Vendor	Product	Version	CPE status
		Affected: 0 , < 0.05 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-08-25T23:07:23.313Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/08/25/6"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "Punk::Plugin::TOTP"
          ],
          "packageName": "Punk-TOTP",
          "packageURL": "pkg:cpan/Punk-TOTP",
          "programFiles": [
            "include/ptotp/ptotp_plugin.h"
          ],
          "programRoutines": [
            {
              "name": "totp_use_recovery"
            },
            {
              "name": "pp_h_use_recovery"
            }
          ],
          "versions": [
            {
              "lessThan": "0.05",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Punk::Plugin::TOTP versions before 0.05 for Perl accept another account\u0027s recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically.\n\nThe helper searches the recovery model for the submitted code\u0027s digest alone, across every user\u0027s rows, so the ownership test that follows is the only thing binding a code to the account it was issued to. That test compares the row\u0027s user_id with the challenged user\u0027s id through Perl\u0027s integer coercion, and an identifier with no leading digits coerces to zero, so any two of them compare equal. User models keyed on a username, an email address or a UUID hit that case, and a numeric key compares as intended.\n\nThe challenge route feeds a submitted value to the helper once TOTP verification fails, so an attacker who knows a victim\u0027s password and holds a recovery code of their own passes the victim\u0027s second factor."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-305",
              "description": "CWE-305 Authentication Bypass by Primary Weakness",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1025",
              "description": "CWE-1025 Comparison Using Wrong Factors",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T21:21:08.073Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://metacpan.org/release/LNATION/Punk-TOTP-0.04/source/include/ptotp/ptotp_plugin.h#L801-827"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://metacpan.org/release/LNATION/Punk-TOTP-0.04/view/lib/Punk/Plugin/TOTP.pm"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/LNATION/Punk-TOTP-0.05/source/Changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to Punk-TOTP 0.05 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Punk::Plugin::TOTP versions before 0.05 for Perl accept another account\u0027s recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically",
      "workarounds": [
        {
          "lang": "en",
          "value": "For deployments that cannot upgrade to 0.05, stop issuing recovery codes and delete the existing totp_recovery rows from the token table. The challenge route then has nothing to match and the second factor rests on TOTP codes alone."
        }
      ],
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-78619",
    "datePublished": "2026-08-25T21:21:08.073Z",
    "dateReserved": "2026-08-24T21:34:55.931Z",
    "dateUpdated": "2026-08-25T23:07:23.313Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-78619\",\"sourceIdentifier\":\"9b29abf9-4ab0-4765-b253-1875cd9b441e\",\"published\":\"2026-08-25T22:17:06.403\",\"lastModified\":\"2026-08-25T23:17:59.283\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Punk::Plugin::TOTP versions before 0.05 for Perl accept another account\u0027s recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically.\\n\\nThe helper searches the recovery model for the submitted code\u0027s digest alone, across every user\u0027s rows, so the ownership test that follows is the only thing binding a code to the account it was issued to. That test compares the row\u0027s user_id with the challenged user\u0027s id through Perl\u0027s integer coercion, and an identifier with no leading digits coerces to zero, so any two of them compare equal. User models keyed on a username, an email address or a UUID hit that case, and a numeric key compares as intended.\\n\\nThe challenge route feeds a submitted value to the helper once TOTP verification fails, so an attacker who knows a victim\u0027s password and holds a recovery code of their own passes the victim\u0027s second factor.\"}],\"affected\":[{\"source\":\"9b29abf9-4ab0-4765-b253-1875cd9b441e\",\"affectedData\":[{\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://cpan.org/modules\",\"packageName\":\"Punk-TOTP\",\"modules\":[\"Punk::Plugin::TOTP\"],\"programFiles\":[\"include/ptotp/ptotp_plugin.h\"],\"programRoutines\":[{\"name\":\"totp_use_recovery\"},{\"name\":\"pp_h_use_recovery\"}],\"packageURL\":\"pkg:cpan/Punk-TOTP\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"0.05\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{},\"weaknesses\":[{\"source\":\"9b29abf9-4ab0-4765-b253-1875cd9b441e\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-305\"},{\"lang\":\"en\",\"value\":\"CWE-1025\"}]}],\"references\":[{\"url\":\"https://metacpan.org/release/LNATION/Punk-TOTP-0.04/source/include/ptotp/ptotp_plugin.h#L801-827\",\"source\":\"9b29abf9-4ab0-4765-b253-1875cd9b441e\"},{\"url\":\"https://metacpan.org/release/LNATION/Punk-TOTP-0.04/view/lib/Punk/Plugin/TOTP.pm\",\"source\":\"9b29abf9-4ab0-4765-b253-1875cd9b441e\"},{\"url\":\"https://metacpan.org/release/LNATION/Punk-TOTP-0.05/source/Changes\",\"source\":\"9b29abf9-4ab0-4765-b253-1875cd9b441e\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/08/25/6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}

FKIE_CVE-2026-78619

Vulnerability from fkie_nvd - Published: 2026-08-25 22:17 - Updated: 2026-08-25 23:17

Severity

Summary

References

	URL	Tags
	9b29abf9-4ab0-4765-b253-1875cd9b441e	https://metacpan.org/release/LNATION/Punk-TOTP-0.04/source/include/ptotp/ptotp_plugin.h#L801-827
	9b29abf9-4ab0-4765-b253-1875cd9b441e	https://metacpan.org/release/LNATION/Punk-TOTP-0.04/view/lib/Punk/Plugin/TOTP.pm
	9b29abf9-4ab0-4765-b253-1875cd9b441e	https://metacpan.org/release/LNATION/Punk-TOTP-0.05/source/Changes
	af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2026/08/25/6

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "Punk::Plugin::TOTP"
          ],
          "packageName": "Punk-TOTP",
          "packageURL": "pkg:cpan/Punk-TOTP",
          "programFiles": [
            "include/ptotp/ptotp_plugin.h"
          ],
          "programRoutines": [
            {
              "name": "totp_use_recovery"
            },
            {
              "name": "pp_h_use_recovery"
            }
          ],
          "versions": [
            {
              "lessThan": "0.05",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Punk::Plugin::TOTP versions before 0.05 for Perl accept another account\u0027s recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically.\n\nThe helper searches the recovery model for the submitted code\u0027s digest alone, across every user\u0027s rows, so the ownership test that follows is the only thing binding a code to the account it was issued to. That test compares the row\u0027s user_id with the challenged user\u0027s id through Perl\u0027s integer coercion, and an identifier with no leading digits coerces to zero, so any two of them compare equal. User models keyed on a username, an email address or a UUID hit that case, and a numeric key compares as intended.\n\nThe challenge route feeds a submitted value to the helper once TOTP verification fails, so an attacker who knows a victim\u0027s password and holds a recovery code of their own passes the victim\u0027s second factor."
    }
  ],
  "id": "CVE-2026-78619",
  "lastModified": "2026-08-25T23:17:59.283",
  "metrics": {},
  "published": "2026-08-25T22:17:06.403",
  "references": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "url": "https://metacpan.org/release/LNATION/Punk-TOTP-0.04/source/include/ptotp/ptotp_plugin.h#L801-827"
    },
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "url": "https://metacpan.org/release/LNATION/Punk-TOTP-0.04/view/lib/Punk/Plugin/TOTP.pm"
    },
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "url": "https://metacpan.org/release/LNATION/Punk-TOTP-0.05/source/Changes"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2026/08/25/6"
    }
  ],
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-305"
        },
        {
          "lang": "en",
          "value": "CWE-1025"
        }
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary"
    }
  ]
}

GHSA-M82C-83JF-3J4V

Vulnerability from github – Published: 2026-08-26 00:30 – Updated: 2026-08-26 00:30

Details

Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically.

The helper searches the recovery model for the submitted code's digest alone, across every user's rows, so the ownership test that follows is the only thing binding a code to the account it was issued to. That test compares the row's user_id with the challenged user's id through Perl's integer coercion, and an identifier with no leading digits coerces to zero, so any two of them compare equal. User models keyed on a username, an email address or a UUID hit that case, and a numeric key compares as intended.

The challenge route feeds a submitted value to the helper once TOTP verification fails, so an attacker who knows a victim's password and holds a recovery code of their own passes the victim's second factor.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-78619"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-305"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-25T22:17:06Z",
    "severity": null
  },
  "details": "Punk::Plugin::TOTP versions before 0.05 for Perl accept another account\u0027s recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically.\n\nThe helper searches the recovery model for the submitted code\u0027s digest alone, across every user\u0027s rows, so the ownership test that follows is the only thing binding a code to the account it was issued to. That test compares the row\u0027s user_id with the challenged user\u0027s id through Perl\u0027s integer coercion, and an identifier with no leading digits coerces to zero, so any two of them compare equal. User models keyed on a username, an email address or a UUID hit that case, and a numeric key compares as intended.\n\nThe challenge route feeds a submitted value to the helper once TOTP verification fails, so an attacker who knows a victim\u0027s password and holds a recovery code of their own passes the victim\u0027s second factor.",
  "id": "GHSA-m82c-83jf-3j4v",
  "modified": "2026-08-26T00:30:52Z",
  "published": "2026-08-26T00:30:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78619"
    },
    {
      "type": "WEB",
      "url": "https://metacpan.org/release/LNATION/Punk-TOTP-0.04/source/include/ptotp/ptotp_plugin.h#L801-827"
    },
    {
      "type": "WEB",
      "url": "https://metacpan.org/release/LNATION/Punk-TOTP-0.04/view/lib/Punk/Plugin/TOTP.pm"
    },
    {
      "type": "WEB",
      "url": "https://metacpan.org/release/LNATION/Punk-TOTP-0.05/source/Changes"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/08/25/6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-78619 (GCVE-0-2026-78619)

FKIE_CVE-2026-78619

GHSA-M82C-83JF-3J4V

Tags

Sightings

Nomenclature