CVE-2026-78655

Name of the Vulnerable Software and Affected Versions Punk::Plugin::TOTP versions prior to 0.05

Description The second-factor attempt limit can be reset by replaying an earlier session cookie. This occurs because the POST handler on the challenge path endpoint tracks the failure count using a tries variable within the totp pending record stored in the session. Since Punk::Session uses signed cookies without a server-side store by default, a client can save a cookie before failed attempts and replay it to reset the counter, bypassing the attempt limit as long as the pending ttl has not expired. This issue does not affect sessions that utilize a server-side store. The attempt limit is separate from the per-address rate limit of 30 requests per 60 seconds registered on the same path.

Recommendations Update to version 0.05 or later. Declare a session store to ensure the pending record and counter are maintained server-side.