The vulnerability in Runtipi allows attackers to bypass the two‑factor authentication mechanism by brute‑forcing the 6‑digit TOTP code through the `/api/auth/verify-totp` endpoint. Because no rate limiting, attempt counting, or account lockout is enforced, an attacker who already possesses a valid username and password can try every possible code. The verification session persists for 24 hours, giving the attacker a full 1,000,000‑code keyspace. At a practical request rate of about 500 requests per second, an exhaustive attack would complete in roughly 33 minutes in the worst case, granting the attacker full access to the user’s account and any privileges it holds.

All Runtipi releases prior to version 4.8.1 are affected. The affected product is runtipi:runtipi. Any deployment using a version older than 4.8.1 with the `/api/auth/verify-totp` endpoint accessible is vulnerable.

The CVSS base score of 8.1 (High) reflects the severity of the bypass. EPSS is under 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating limited current exploitation activity. Attackers must first obtain valid credentials through phishing, credential stuffing, or a data breach, and then remotely hit the authenticated endpoint. Once credentials are known, the lack of rate limiting makes the attack highly feasible and the risk of compromise substantial.