FileRise authentication does not enforce single-use of TOTP codes. An attacker who has the target account’s primary credential can capture a 6‑digit code after its successful use and replay it in another session before the time window expires. This flaw does not disclose credentials by itself, but it allows an attacker who already controls the account to re‑authenticate and access protected resources, effectively enabling a session hijack or persistent access within the same time window.

All releases of FileRise before version 3.23.0, developed by error311.

The vulnerability has a CVSS score of 6.4, indicating a moderate impact. EPSS is not available, so the current exploitation probability is unknown, and the issue is not listed in CISA’s KEV catalog. The attack vector is remote over the network, requiring the attacker to have the victim’s primary login credentials. Once credentials are known, the attacker can capture a valid TOTP on a successful login and replay it in a parallel pending‑login session, gaining authenticated access without obtaining new credentials.