{"apiVersion":"1.0","identifier":"CVE-2026-78619","description":"Punk::Plugin::TOTP versions before 0.05 for Perl accept another account-s recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically. The helper searches the recovery model for the submitted code-s digest alone, across every user-s rows, so the ownership test that follows is the only thing binding a code to the account it was issued to. That test compares the row-s user_id with the challenged user-s id through Perl-s integer coercion, and an identifier with no leading digits coerces to zero, so any two of them compare equal. User models keyed on a username, an email address or a UUID hit that case, and a numeric key compares as intended. The challenge route feeds a submitted value to the helper once TOTP verification fails, so an attacker who knows a victim-s password and holds a recovery code of their own passes the victim-s second factor.","publishedAt":"2026-08-25T22:17:06","lastModifiedAt":"2026-08-26T20:18:02","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-78619","cvssScore":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00616,"riskScore":1.03,"affectedProduct":"Punk::Plugin::TOTP","affectedVersions":"<0.05","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-78619","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-78619","en":"https://www.redsauce.net/en/cves/CVE-2026-78619","fr":"https://www.redsauce.net/fr/cves/CVE-2026-78619","pt":"https://www.redsauce.net/pt/cves/CVE-2026-78619","de":"https://www.redsauce.net/de/cves/CVE-2026-78619","sk":"https://www.redsauce.net/sk/cves/CVE-2026-78619","el":"https://www.redsauce.net/el/cves/CVE-2026-78619"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-78619"}}