CVE-2026-78655: CWE-307 Improper Restriction of Excessive Authentication Attempts

The vulnerability in Punk::Plugin::TOTP (prior to version 0.05) arises from improper restriction of excessive authentication attempts (CWE-307). The plugin tracks second-factor authentication failures in a session cookie (client-side) rather than server-side, enabling an attacker to replay an earlier session cookie to reset the failure count and bypass the attempt limit. The session cookie is signed but contains the failure count and pending record, which remain valid until expiry. Applications that configure a server-side session store are not vulnerable because the failure count is then maintained server-side. The plugin also enforces a per-address rate limit of 30 requests per 60 seconds, which is separate from the vulnerable attempt limit mechanism.

An attacker can bypass the second-factor authentication attempt limit by replaying a previously saved session cookie, allowing unlimited attempts to guess the second-factor code within the cookie's expiry time. This can lead to compromise of accounts protected by the vulnerable plugin if the second-factor code is guessed or brute-forced. The vulnerability affects confidentiality and integrity but does not impact availability. Applications using server-side session stores are not affected.

No official fix or patch is currently documented for this vulnerability. Users should configure Punk::Plugin::TOTP to use a server-side session store, which prevents the failure count from being stored client-side and mitigates the issue. Additionally, the plugin's per-address rate limiting remains effective and should be maintained. Monitor vendor advisories for updates or official patches addressing this issue.