CVE-2026-78619

Name of the Vulnerable Software and Affected Versions Punk::Plugin::TOTP versions prior to 0.05

Description The software incorrectly validates recovery codes during the two-factor authentication challenge. The totp use recovery() function searches the recovery model for a submitted code's digest across all users. The subsequent ownership verification compares the user id of the recovery code row with the challenged user's ID using Perl's integer coercion. If identifiers do not start with digits (such as usernames, email addresses, or UUIDs), they are coerced to zero, causing the comparison to evaluate as equal regardless of the actual user. This allows an attacker who possesses a valid password and their own recovery code to bypass the second factor of a victim's account.

Recommendations Update to version 0.05 or later.