The Bug: Punk::Plugin::TOTP versions prior to 0.05 allow an attacker who knows a victim's password to supply a recovery code issued to their own account and successfully complete the second factor. This is possible because the code lookup compares the user identifier numerically, treating any non‑numeric identifier as zero, so a second account with a non‑numeric user_id matches the victim's. The result is that an attacker can log in as another user without possessing that user’s TOTP code. The weakness is a misuse of numerical coercion in the authentication flow, classified as CWE‑1025 and CWE‑305. The impact is that authorized access is allowed for a victim account, compromising confidentiality and potentially leading to further privilege escalation.

Punk::Plugin::TOTP for Perl versions earlier than 0.05 are affected. Any installation that uses the 0.05 or earlier release of this module and has two‑factor authentication enabled with recovery codes is vulnerable. The affected product is the Punk::Plugin::TOTP module that exposes the totp_use_recovery helper in Perl.

The CVSS score is 9.8, reflecting a critical severity. The EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog. The abuse requires the attacker to know the victim’s password and possess their own recovery code, which limits the attack to accounts where the password secret is exposed. Nevertheless, the path to exploitation is straightforward: submit the victim’s credentials, cause TOTP verification to fail, and then submit a valid recovery code issued to the attacker’s own account. The numeric coercion bug allows this code to be accepted for any non‑numeric user_id, including typical alphanumeric usernames, emails, or UUIDs. Because failure to pass TOTP triggers the recovery path automatically, the attack does not require privileged interaction beyond credential knowledge. The risk thus depends on the likelihood of password compromise and the prevalence of non‑numeric user identifiers but should be treated as significant for environments with sensitive data.