A time‑of‑check/time‑of‑use condition in fastschema’s verifyOTPSession function allows an unauthenticated remote attacker to read and increment an OTP attempt counter in separate, non‑atomic steps. This race condition lets multiple concurrent requests observe the same attempt count below the enforcement threshold and proceed past the limit check before the counter is updated, effectively bypassing the intended OTP attempt restriction and permitting brute‑force attempts on the six‑digit code.

fastschema:fastschema for all releases up to and including v0.15.1 are susceptible. No newer releases are identified as affected in the current data.

The vulnerability has a CVSS score of 7.4, indicating a high impact and moderate exploitability. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers can target the account recovery endpoint remotely without authentication, leveraging the race condition to attempt up to many more OTP verifications than the design allows. The exploit requires only the ability to send concurrent requests to the OTP verification service, making it a realistic threat for attackers with internet access to the affected application.