CVE-2026-78619: CWE-305 Authentication Bypass by Primary Weakness

In Punk::Plugin::TOTP versions prior to 0.05, the two-factor authentication recovery code verification process is flawed. The helper function searches for the recovery code digest across all users and then verifies ownership by comparing user IDs numerically. Due to Perl's integer coercion, user identifiers without leading digits coerce to zero, causing the ownership test to incorrectly succeed for different users. This enables an attacker with knowledge of a victim's password and possession of their own recovery code to bypass the victim's second-factor authentication challenge.

Successful exploitation allows an attacker to bypass two-factor authentication by using their own recovery code in place of the victim's, effectively compromising the victim's account despite the presence of two-factor authentication. This leads to full account compromise with confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling recovery code usage or applying additional access controls to mitigate risk.