CVE-2026-103977: CWE-307: Improper Restriction of Excessive Authentication Attempts in error311 FileRise

FileRise, a self-hosted web-based file manager, improperly restricts excessive authentication attempts for TOTP verification prior to version 3.23.0. Failed TOTP attempts are stored in the session ($_SESSION), which is session-specific rather than account-wide. An attacker who already has valid primary credentials for a target account can restart the login process in a new session, resetting the TOTP attempt counter and effectively bypassing the intended limit of five attempts. This allows continued online guessing of the second-factor TOTP code. The vulnerability is addressed in FileRise 3.23.0 by implementing a durable account-wide limit on TOTP verification attempts.

An attacker with valid primary credentials can bypass the second-factor TOTP attempt limit by restarting the login workflow in a new session, enabling unlimited online guessing of TOTP codes. This undermines the effectiveness of two-factor authentication, potentially leading to unauthorized account access. The vulnerability does not affect confidentiality, integrity, or availability beyond the authentication bypass risk.

Upgrade FileRise to version 3.23.0 or later, where the issue is fixed by enforcing an account-wide limit on TOTP verification attempts. No other mitigations are specified or required once the official fix is applied.