Brute Force Vulnerability in Runtipi Personal Homeserver Product

CVE-2026-32729

What is CVE-2026-32729?

The Runtipi personal homeserver product contains a vulnerability in its /api/auth/verify-totp endpoint, where it fails to implement essential security measures such as rate limiting, attempt counting, or account lockout. This oversight allows attackers who have acquired valid user credentials to execute a brute-force attack on the 6-digit TOTP code, ultimately bypassing the two-factor authentication mechanism. The session for TOTP verification remains active for up to 24 hours, which significantly increases the window for potential attacks, enabling an exhaustive search through 1,000,000 possible codes at a rate of approximately 500 requests per second. Such an attack could be completed in around 33 minutes under the worst-case conditions. This issue has been addressed in version 4.8.1.

References