The vulnerability in Authen::TOTP occurs because the Perl library generates one‑time‑password secrets using the non‑cryptographically secure rand function. This predictability allows an attacker who can infer the internal random state to calculate or guess the secret, thereby forging one‑time passwords and compromising authentication integrity.

All installations of Authen::TOTP prior to version 0.1.1 are affected. The vendor TCHATZI released 0.1.1 which switches to a proper cryptographically secure random source, eliminating the predictability.

The CVE description does not specify a precise attack vector, but it is inferred that an attacker would need some level of access to the system running the vulnerable library to exploit the weakness. No network or remote access requirements are stated. EPSS is not available and the vulnerability is not listed in KEV, yet the severity on authentication integrity suggests a high impact, as reflected by a CVSS score of 7.5. Systems that rely on Authen::TOTP for user authentication should consider the risk significant and act accordingly.