Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-78655— Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session

Quick assessment

Affected
CVE-2026-78655
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 模块 Punk::Plugin::TOTP 在 0.05 版本之前存在安全漏洞，攻击者可以通过重放早期的会话 Cookie 来重置第二因素认证（TOTP）的尝试次数限制，因为挑战（challenge）路由在会话中记录失败次数。 在挑战路径的 POST 处理器中，失败计数以 字段的形式存储在会话（session）中的 记录内；每次收到错误的验证码时，该计数递增，当达到设定的最大尝试次数（默认为 5 次）后， 记录将被删除。Punk::Session 模块默认将会话数据保存在一个签名后的 Cookie 中，除

AI Predicted 5.3 Difficulty: Easy

Possible ATT&CK Techniques 1 AI

T1528 · Steal Application Access Token

I. Basic Information for CVE-2026-78655

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session
Source: CVE Program / CVE List V5
Vulnerability Description
Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session. The POST handler on challenge_path keeps the failure count as tries inside the totp_pending record in the session, raising it on each rejected code and deleting the pending record once it reaches attempts, five by default. Punk::Session carries the session in a signed cookie unless the application declares a store, and keeps no server-side record, so an earlier value of the same session stays valid until the expiry stamped inside it. A client that saves the cookie before its failed attempts and presents it again gets the pending record back with its counter, and the limit never fires. The replayed record is accepted while its own expiry, pending_ttl seconds from the challenge and 300 by default, has not passed. Sessions declared with a store are not affected: the pending record and its counter then live server-side. The attempt limit does not bound guessing of the second factor, which is left to the per-address rate limit the plugin registers on the same path, 30 requests per 60 seconds.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
过多认证尝试的限制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 0.05 -

II. Public POCs for CVE-2026-78655

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-78655

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-78655 (1)

Other References for CVE-2026-78655 (1)

Other References for CVE-2026-78655 (1)

IV. Related Vulnerabilities

Same weakness: CWE-307

V. Comments for CVE-2026-78655

No comments yet

Leave a comment