CVE-2026-78655

Punk::Plugin::TOTP versions before 0.05 for Perl store the second-factor failure counter inside a client-side signed session cookie . An attacker who saves a cookie from before their failed attempts can replay it, restoring the counter and preventing the attempt limit (five by default) from firin...