The vulnerability is a time-of-check/time-of-use (TOCTOU) race condition in fastschema versions up to 0.15.1. It allows an unauthenticated remote attacker to bypass the one-time password (OTP) attempt limit during the account recovery flow. By exploiting this flaw, an attacker can perform brute-force attacks against 6-digit OTP codes, increasing the risk of unauthorized account access. The CVSS 3.1 base score is 7.4, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

Successful exploitation allows an unauthenticated remote attacker to bypass OTP attempt limits, enabling brute-force attacks on 6-digit OTP codes. This can lead to unauthorized access to user accounts, compromising confidentiality and integrity of affected accounts. Availability is not impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, consider implementing additional monitoring or rate limiting on OTP attempts if possible to mitigate brute-force risks.