LNATION Punk-Plugin-TOTP up to 0.04 Recovery Code Verification ptotp_plugin.h totp_use_recovery integer coercion

Summaryinfo

A vulnerability marked as critical has been reported in LNATION Punk-Plugin-TOTP up to 0.04. This vulnerability affects the function totp_use_recovery of the file include/ptotp/ptotp_plugin.h of the component Recovery Code Verification. Performing a manipulation results in integer coercion. This vulnerability was named CVE-2026-78619. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as critical has been found in LNATION Punk-Plugin-TOTP up to 0.04. This affects the function totp_use_recovery of the file include/ptotp/ptotp_plugin.h of the component Recovery Code Verification. The manipulation with an unknown input leads to a integer coercion vulnerability. CWE is classifying the issue as CWE-192. Integer coercion refers to a set of flaws pertaining to the type casting, extension, or truncation of primitive data types. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically. The helper searches the recovery model for the submitted code's digest alone, across every user's rows, so the ownership test that follows is the only thing binding a code to the account it was issued to. That test compares the row's user_id with the challenged user's id through Perl's integer coercion, and an identifier with no leading digits coerces to zero, so any two of them compare equal. User models keyed on a username, an email address or a UUID hit that case, and a numeric key compares as intended. The challenge route feeds a submitted value to the helper once TOTP verification fails, so an attacker who knows a victim's password and holds a recovery code of their own passes the victim's second factor.

It is possible to read the advisory at metacpan.org. This vulnerability is uniquely identified as CVE-2026-78619 since 08/24/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 0.05 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• LNATION

Name

• Punk-Plugin-TOTP

Version

• 0.04

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion