Description

A time-of-check/time-of-use (TOCTOU) race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on the account recovery flow, enabling brute-force attacks on 6-digit OTP codes. The verifyOTPSession function in pkg/auth/local.go reads and increments the attempt counter in separate non-atomic operations, allowing concurrent requests to observe the same attempt count below the threshold and proceed past the limit check before any update is committed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-10T11:17:31.390Z",
  "pubdate": "2026-08-10T11:17:31.390Z",
  "executiveSummary": "A time-of-check/time-of-use race condition vulnerability exists in fastschema through v0.15.1 within the account recovery flow.\nThe vulnerability allows an unauthenticated remote attacker to bypass the One-Time Password attempt limit, facilitating brute-force attacks against 6-digit OTP codes.\nThe flaw stems from non-atomic read and increment operations on the attempt counter within the authentication logic, which exposes systems to concurrent request exploitation.\nSuccessful exploitation compromises account recovery security mechanisms, potentially leading to unauthorized account access through credential or code guessing.\nThe risk implication is high for exposed instances relying on the default recovery mechanism, as it neutralizes the intended brute-force protections without requiring prior authentication or elevated privileges.\nExploitation requires network access to the account recovery endpoint and the ability to dispatch concurrent HTTP requests to bypass the state validation threshold.",
  "technicalDetails": "The vulnerability resides in the verifyOTPSession function located in pkg/auth/local.go.\nThe root cause of the flaw is a time-of-check/time-of-use (TOCTOU) race condition caused by non-atomic operations when handling the OTP attempt counter.\nSpecifically, the application reads the current attempt count and subsequently increments it in separate, non-atomic steps.\nWhen multiple concurrent requests hit the verifyOTPSession function simultaneously, they can read the same attempt count value concurrently.\nBecause the counter has not yet been updated and committed when subsequent threads perform their checks, multiple concurrent requests observe an attempt count below the enforced security threshold.\nConsequently, these concurrent validation attempts proceed past the attempt limit check before the state is updated.\nThis race condition effectively neutralizes the attempt limit mechanism designed to protect 6-digit OTP codes in the account recovery flow.\nAffected versions include fastschema through v0.15.1.\nThe vulnerability is exposed over the network, and the attack can be executed by an unauthenticated remote attacker with zero prior privileges.\nAttackers can leverage this behavior by scripting multi-threaded or asynchronous payload bursts targeting the OTP verification endpoint, allowing them to test numerous combinations within a short temporal window without triggering the intended lockout or denial thresholds."
}