CVE-2026-78655

Punk::Plugin::TOTP versions before 0.05 for Perl store the second-factor failure counter inside a client-side signed session cookie . An attacker who saves a cookie from before their failed attempts can replay it, restoring the counter and preventing the attempt limit (five by default) from firin...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration through improper handling of the Logout. An attacker can maintain unauthorized access by replaying a previously captured session cookie after a user logs out. Remediation Upgrade...