CVE-2026-78655: Punk::Plugin::TOTP Auth Bypass Vulnerability

CVE-2026-78655 Overview

CVE-2026-78655 affects Punk::Plugin::TOTP versions before 0.05 for Perl. The plugin stores the second-factor failure counter inside a signed session cookie. An attacker who saves the cookie before submitting failed TOTP codes can replay the earlier cookie to reset the counter. This bypasses the default five-attempt limit and allows extended brute-force guessing of the time-based one-time password (TOTP). The weakness maps to CWE-307: Improper Restriction of Excessive Authentication Attempts.

Critical Impact
An unauthenticated network attacker can replay a session cookie to reset the TOTP attempt counter and brute-force the second factor within the 300-second pending window.

Affected Products

Punk::Plugin::TOTP versions prior to 0.05 for Perl
Applications using Punk::Session without a server-side session store
Deployments relying on the default pending_ttl of 300 seconds and attempts of 5

Discovery Timeline

2026-08-25 - CVE-2026-78655 published to NVD
2026-08-25 - Vulnerability discussed on the OpenWall OSS Security list
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78655

Vulnerability Analysis

The Punk::Plugin::TOTP plugin registers a POST handler on challenge_path that validates submitted TOTP codes against a totp_pending record stored in the user session. Each failed submission increments a tries counter inside that record. Once tries reaches attempts (default 5), the pending record is deleted and the challenge fails closed.

The counter is only reliable when the session is persisted server-side. Punk::Session serializes session data into a signed cookie unless the application explicitly declares a store. Because no server-side state exists, prior versions of the cookie remain cryptographically valid until the expiry timestamp inside them lapses.

An attacker captures the cookie after the challenge is issued but before any failed attempts increment tries. After exhausting attempts, the attacker resubmits the earlier cookie. The server accepts it, restores the pending record with a lower counter, and continues to accept guesses. Guessing is bounded only by the per-address rate limit of 30 requests per 60 seconds and the pending_ttl of 300 seconds by default.

Root Cause

The root cause is client-controlled authentication state. The failure counter that enforces attempts is stored inside a signed cookie without a server-side revocation mechanism, so replaying a stale-but-valid cookie rewinds the counter [CWE-307].

Attack Vector

Exploitation requires no authentication and no user interaction. The attacker interacts with the challenge endpoint over the network:

Initiate the login flow and obtain a session cookie carrying a fresh totp_pending record with tries=0.
Save that cookie value locally.
Submit incorrect TOTP codes until the counter reaches the limit.
Replace the current cookie with the saved copy and resume guessing.
Repeat until the correct TOTP is found or pending_ttl expires.

Within the 300-second window and the 30 requests per 60 seconds rate limit, an attacker can submit roughly 150 guesses per pending record without ever tripping the attempt cap.

Detection Methods for CVE-2026-78655

Indicators of Compromise

Repeated POST requests to the configured challenge_path from a single source address at or near 30 requests per 60 seconds.
Multiple requests from the same client presenting session cookies with identical or overlapping issued timestamps.
Successful TOTP validations preceded by high volumes of failed attempts in application logs.

Detection Strategies

Instrument the challenge handler to log the session identifier, tries value, and cookie issuance timestamp on every request, then alert on decreasing tries for the same identifier.
Correlate authentication logs to flag source IPs that submit more than five failed TOTP codes against the same account within pending_ttl.
Baseline normal TOTP submission volume per user and alert on deviations that indicate automated guessing.

Monitoring Recommendations

Forward Perl application logs and reverse-proxy access logs into a centralized analytics platform for correlation across the challenge endpoint.
Track the ratio of failed to successful TOTP submissions per account and per source address on a rolling basis.
Monitor for user agents or clients replaying identical Set-Cookie values across separate TCP sessions targeting the challenge route.

How to Mitigate CVE-2026-78655

Immediate Actions Required

Upgrade Punk::Plugin::TOTP to version 0.05 or later. See the Punk-TOTP 0.05 Changes log.
Configure Punk::Session with a server-side store so totp_pending and its counter live outside the cookie. See the Punk::Session module documentation.
Reduce pending_ttl from the 300-second default and lower the per-address rate limit below 30 requests per 60 seconds until the upgrade is complete.

Patch Information

The maintainer released Punk-TOTP-0.05 addressing the counter-replay issue. Consult the Punk::Plugin::TOTP module source for the vulnerable implementation and verify the deployed version with cpan -D Punk::Plugin::TOTP.

Workarounds

Declare a server-side session store (for example, a database or key-value backend) in the Punk application configuration so session state is not carried in the cookie.
Bind the totp_pending record to a monotonically increasing nonce that the server tracks and rejects on reuse.
Invalidate prior session cookies whenever a new challenge is issued, ensuring only the most recent cookie value is accepted.

bash

# Configuration example: upgrade the plugin and require a server-side session store
cpanm Punk::Plugin::TOTP@0.05

# In the Punk application configuration, declare a store so session state
# is not held in the signed cookie. Consult Punk::Session documentation
# for the store backends supported by your deployment.