fastschema up to 0.15.1 OTP Verification pkg/auth/local.go verifyOTPSession toctou

Summaryinfo

A vulnerability was found in fastschema up to 0.15.1 and classified as critical. This vulnerability affects the function verifyOTPSession of the file pkg/auth/local.go of the component OTP Verification. Executing a manipulation can lead to toctou. This vulnerability is tracked as CVE-2026-72584. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in fastschema up to 0.15.1. It has been declared as critical. This vulnerability affects the function verifyOTPSession of the file pkg/auth/local.go of the component OTP Verification. The manipulation with an unknown input leads to a toctou vulnerability. The CWE definition for the vulnerability is CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. As an impact it is known to affect integrity, and availability. CVE summarizes:

A time-of-check/time-of-use (TOCTOU) race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on the account recovery flow, enabling brute-force attacks on 6-digit OTP codes. The verifyOTPSession function in pkg/auth/local.go reads and increments the attempt counter in separate non-atomic operations, allowing concurrent requests to observe the same attempt count below the threshold and proceed past the limit check before any update is committed.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-72584 since 08/10/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• fastschema

Version

• 0.15.0
• 0.15.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion