CVE-2026-78619

*** Pendiente de traducción *** Punk::Plugin::TOTP versions before 0.05 for Perl accept another account&amp;#39;s recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically.<br /> <br /> The helper searches the recovery model for the submitted code&amp;#39;s digest alone, across every user&amp;#39;s rows, so the ownership test that follows is the only thing binding a code to the account it was issued to. That test compares the row&amp;#39;s user_id with the challenged user&amp;#39;s id through Perl&amp;#39;s integer coercion, and an identifier with no leading digits coerces to zero, so any two of them compare equal. User models keyed on a username, an email address or a UUID hit that case, and a numeric key compares as intended.<br /> <br /> The challenge route feeds a submitted value to the helper once TOTP verification fails, so an attacker who knows a victim&amp;#39;s password and holds a recovery code of their own passes the victim&amp;#39;s second factor.