Session Cookie Vulnerability in Punk Plugin for Perl

CVE-2026-78655

What is CVE-2026-78655?

The Punk::Plugin::TOTP version before 0.05 for Perl presents a vulnerability where an attacker can reset the second-factor authentication attempt limit by replaying a valid session cookie. This issue arises due to the handling of failure attempts in the session's pending record not being correctly secured. When the authentication fails, the failure count is stored in the session; however, without server-side management, the cookie maintains its validity even after attempts are made. Thus, if an attacker retrieves an earlier saved cookie prior to its expiry, they can bypass the authentication limits, enabling repeated attempts to guess valid second-factor codes.

References