CVE-2026-72584

Name of the Vulnerable Software and Affected Versions fastschema versions prior to 0.15.2

Description A time-of-check/time-of-use (TOCTOU) race condition occurs in the account recovery flow. This issue allows an unauthenticated remote attacker to bypass the One-Time Password (OTP) attempt limit, facilitating brute-force attacks on 6-digit OTP codes. The verifyOTPSession() function in pkg/auth/local.go reads and increments the attempt counter using separate non-atomic operations. This allows concurrent requests to see the same attempt count below the threshold and bypass the limit check before the update is committed. A TOCTOU race condition is a software bug where a program checks the state of a resource and then acts on that resource, but the state changes between the check and the action.

Recommendations Update fastschema to version 0.15.2 or later.