CVE-2026-78619: Punk::Plugin::TOTP Auth Bypass Vulnerability

CVE-2026-78619 Overview

CVE-2026-78619 is an authentication bypass vulnerability in Punk::Plugin::TOTP for Perl, affecting all versions before 0.05. The flaw resides in the totp_use_recovery helper, which searches the recovery model using only the submitted code's digest and then performs a flawed ownership check. The check compares user_id values through Perl's integer coercion, causing any non-numeric identifier (username, email, or UUID) to coerce to zero and compare equal. An attacker who knows a victim's password and holds a valid recovery code for their own account can pass the victim's two-factor challenge. This is classified under CWE-305: Authentication Bypass by Primary Weakness.

Critical Impact
An attacker with a stolen password and their own recovery code can bypass TOTP-based multi-factor authentication for any account whose user identifier is non-numeric.

Affected Products

Punk::Plugin::TOTP versions prior to 0.05
Perl applications using Punk::Plugin::TOTP with non-numeric user identifiers (username, email, UUID)
Applications relying on the totp_use_recovery helper for recovery-code validation

Discovery Timeline

2026-08-25 - CVE-2026-78619 published to NVD and disclosed on the Openwall OSS Security mailing list
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78619

Vulnerability Analysis

The vulnerability is an authentication bypass caused by unsafe type coercion in the recovery-code ownership check. The totp_use_recovery helper in Punk::Plugin::TOTP.pm accepts a submitted recovery code, hashes it, and searches the recovery model for a matching digest across every user's rows. Because the initial lookup is not scoped to the challenged user, the subsequent ownership test is the only mechanism binding a code to its owner.

That ownership test compares the stored row's user_id field with the challenged user's id using Perl's numeric comparison operators. When both sides are non-numeric strings such as usernames, email addresses, or UUIDs without leading digits, each coerces to the integer 0, and the comparison evaluates as equal. Any recovery code held by any attacker therefore satisfies the ownership check for any victim account.

Root Cause

The root cause is the use of numeric comparison on identifiers that may be strings. Perl's == operator coerces both operands to numbers; strings without leading digits become 0. The recovery lookup should be scoped to the challenged user, and the identity comparison should use the string operator eq. Neither guard is present in versions before 0.05.

Attack Vector

The challenge route invokes totp_use_recovery with the submitted value whenever TOTP verification fails. An attacker who has obtained the victim's password through phishing, credential stuffing, or database leaks, and who possesses any valid recovery code for an account of their own, submits that recovery code at the victim's second-factor prompt. The digest lookup finds the attacker's row, the flawed ownership check returns true, and the attacker completes authentication as the victim. The attack requires no user interaction and works over the network.

See the vulnerable source in TOTP.pm on MetaCPAN and the 0.05 change log for the corrected implementation.

Detection Methods for CVE-2026-78619

Indicators of Compromise

Successful two-factor logins immediately following one or more failed TOTP verifications from the same session or IP.
Recovery-code redemption events where the redeemed code's stored user_id does not match the account that completed the login.
Authentication events for accounts with non-numeric primary keys (usernames, emails, UUIDs) that used a recovery code the account never generated.

Detection Strategies

Audit application logs for calls to totp_use_recovery and correlate the digest-matched row's owner with the authenticated account.
Alert on any recovery-code consumption where the row's user_id differs from the session's user identifier.
Baseline recovery-code usage frequency and flag deviations, particularly successful challenges after failed TOTP attempts.

Monitoring Recommendations

Instrument the challenge route to log both the challenged user identifier and the recovery row identifier for post-hoc correlation.
Forward authentication and MFA events to a centralized log store and retain them long enough to investigate suspected account takeovers.
Monitor for password-spray or credential-stuffing patterns preceding recovery-code submissions, since this attack requires prior password compromise.

How to Mitigate CVE-2026-78619

Immediate Actions Required

Upgrade Punk::Plugin::TOTP to version 0.05 or later on all affected systems.
Invalidate outstanding recovery codes for all users after upgrading and require regeneration.
Force password resets and re-enrollment of MFA for accounts showing suspicious recovery-code activity.

Patch Information

The maintainer released Punk::Plugin::TOTP version 0.05 on CPAN, which scopes the recovery lookup to the challenged user and uses string comparison for the ownership check. Details are documented in the 0.05 Changes file on MetaCPAN. Review the plugin header on MetaCPAN to confirm the fixed release is deployed.

Workarounds

If upgrading immediately is not possible, disable the recovery-code path in the challenge route and require administrative account recovery instead.
Temporarily replace non-numeric user identifiers with numeric primary keys in the recovery model comparison logic.
Add a pre-check that rejects recovery submissions whose stored user_id does not string-equal the challenged user's id.

bash

# Upgrade to the fixed release from CPAN
cpanm Punk::Plugin::TOTP@0.05

# Verify the installed version
perl -MPunk::Plugin::TOTP -e 'print $Punk::Plugin::TOTP::VERSION, "\n"'