This vulnerability is a session replay flaw (CWE-307, CWE-642) that allows an attacker to reset the OTP failure counter, enabling repeated guesses of the second factor. The Punk::Plugin::TOTP module keeps the OTP failure counter inside the signed session cookie when no server‑side store is configured. An attacker who captures a session cookie that contains a pending OTP challenge can replay that cookie before it expires, resetting the counter to a low value and preventing the internal limit from incrementing. This allows repeated attempts to guess an OTP without ever reaching the plugin’s attempt threshold. The vulnerability is therefore a form of replay attack that undermines the second‑factor enforcement.

The issue is found in the Punk::Plugin::TOTP module used by Perl web applications. All releases prior to version 0.05, including 0.04 and earlier, are affected because they rely on Punk::Session without a server‑side store. The fix requires upgrading to 0.05 or later and adding the columns that store the failure count (totp_failed and totp_failed_at by default) to the user table.

The CVSS score is 9.1, indicating high severity, and the EPSS score is <1%, with the vulnerability not listed in the CISA KEV catalog. The attack requires an attacker to possess a valid session cookie that contains a pending OTP challenge; the cookie expires after the configured pending_ttl, 300 seconds by default, giving the attacker a limited but sufficient window for replay. Even with the plugin’s per‑address rate limit of 30 requests per 60 seconds, an attacker can cycle through OTP guesses within that quota, effectively bypassing the second‑factor retry limit. Because the vulnerability allows repeated guessing of the second factor, it poses a moderate to high risk for systems that rely on this plugin for two‑factor authentication. The risk is higher in environments where the failed OTP counter is not persisted outside the client side.