CVE-2026-78655

Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session. The POST handler on challengepath keeps the failure count as tries inside the totppending record in...

CVE-2026-78655 Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session

Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session. The POST handler on challengepath keeps the failure count as tries inside the totppending record in...

CVE-2026-78655

The Punk::Plugin::TOTP Perl plugin (versions before 0.05 ) is vulnerable to a second-factor attempt limit reset. The challenge_path handler stores failure counts within the totp_pending record of the session. Because Punk::Session defaults to using signed cookies without server-side records, an a...

CVE-2026-78655 Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session

Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session. The POST handler on challengepath keeps the failure count as tries inside the totppending record in...

PT-2026-81864

Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session. The POST handler on challenge path keeps the failure count as tries inside the totp pending record ...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration through improper handling of the Logout. An attacker can maintain unauthorized access by replaying a previously captured session cookie after a user logs out. Remediation Upgrade...