Authentication Bypass in FileRise Web-Based File Manager

CVE-2026-103977

What is CVE-2026-103977?

An authentication bypass vulnerability exists in FileRise, a self-hosted web-based file management tool. In versions prior to 3.23.0, the application improperly manages the storage of failed TOTP (time-based one-time password) verification attempts in the $_SESSION. If an attacker has access to valid primary credentials of a target account, they can exploit this flaw by initiating a new login session. This behavior allows them to circumvent the intended five-attempt limit for TOTP guesses, effectively enabling continued unauthorized guessing attempts. This vulnerability has been addressed in version 3.23.0, where proper limits are enforced across the session.

References