A time‑of‑check/time‑of‑use race condition in fastschema versions up to v0.15.1 allows an unauthenticated remote attacker to send concurrent OTP verification requests to the account recovery endpoint. The system reads the current OTP attempt counter, then, before the counter is updated, accepts additional requests that exceed the intended limit. This bypass enables brute‑force attacks on six‑digit OTP codes, potentially compromising user accounts. The flaw is a classic TOCTOU vulnerability (CWE‑367).

Fastschema Fastschema for all releases up to and including v0.15.1 are susceptible. No newer releases are identified as affected in the current data.

The vulnerability has a CVSS score of 7.4, indicating a high impact and moderate exploitability. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers can target the account recovery endpoint remotely without authentication, leveraging the race condition to attempt many more OTP verifications than the design allows. The exploit requires only the ability to send concurrent requests to the OTP verification service, making it a realistic threat for attackers with internet access to the affected application.