Description

Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically. The helper searches the recovery model for the submitted code's digest alone, across every user's rows, so the ownership test that follows is the only thing binding a code to the account it was issued to. That test compares the row's user_id with the challenged user's id through Perl's integer coercion, and an identifier with no leading digits coerces to zero, so any two of them compare equal. User models keyed on a username, an email address or a UUID hit that case, and a numeric key compares as intended. The challenge route feeds a submitted value to the helper once TOTP verification fails, so an attacker who knows a victim's password and holds a recovery code of their own passes the victim's second factor.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-25T22:17:06.403Z",
  "pubdate": "2026-08-25T22:17:06.403Z",
  "executiveSummary": "Punk::Plugin::TOTP versions before 0.05 are susceptible to a critical authentication bypass vulnerability due to insecure type coercion during two-factor authentication recovery checks.\nThe vulnerability allows an attacker who possesses valid credentials for a victim's account and their own recovery code to bypass the secondary TOTP challenge.\nThis occurs because the system incorrectly validates account ownership by comparing user identifiers using Perl's numeric integer coercion.\nNon-numeric user identifiers, such as those based on strings, email addresses, or UUIDs, are coerced to zero, causing the application to equate different users' recovery codes.\nThe risk is severe, as it effectively nullifies the protection provided by two-factor authentication, allowing unauthorized account access if the primary password is compromised.\nExploitation requires the attacker to possess their own recovery code and the target's primary login credentials, effectively bypassing the intended security controls of the authentication flow.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the recovery code verification helper in Punk::Plugin::TOTP, specifically within the logic that cross-references a submitted recovery code with a user account.\nThe helper performs a database lookup for the submitted recovery code digest across all users' records. The vulnerability is triggered during the subsequent ownership validation step.\nPerl's numeric integer coercion treats non-numeric strings as zero. When a system uses non-integer identifiers (e.g., usernames, UUIDs, or email addresses) as the user_id, these identifiers are coerced to zero during the comparison process.\nIf an attacker submits their own valid recovery code during a victim's TOTP challenge, the system identifies the code's digest in the database. The validation logic then compares the stored user_id of that recovery code with the user_id of the account currently undergoing the challenge.\nBecause the comparison utilizes loose equality involving numeric coercion, two distinct non-numeric identifiers (both coercing to zero) are treated as identical. This bypasses the ownership check, tricking the system into accepting the attacker's recovery code as valid for the victim's session.\nThe attack flow proceeds as follows: First, the attacker gains access to the victim's primary credentials (e.g., via phishing or credential stuffing). Second, when prompted for the TOTP challenge, the attacker provides their own recovery code. Third, the application fails the TOTP verification but attempts to validate the recovery code. Fourth, the insecure comparison fails to distinguish between the attacker's account ID and the victim's account ID due to the integer coercion flaw. Finally, the application grants the attacker authenticated access to the victim's account.\nThe vulnerable component is the recovery verification logic in Punk::Plugin::TOTP, specifically in versions prior to 0.05. The authentication requirements for this exploit include knowledge of the victim's primary password and possession of the attacker's own, legitimate recovery code issued by the same plugin. No special privileges are required by the attacker beyond standard user access to the platform."
}