A lack of rate limiting in the Runtipi TOTP verification endpoint allows authenticated attackers to bypass two-factor authentication via brute-force, leading to unauthorized account access.

The /api/auth/verify-totp endpoint lacks rate limiting, account lockout mechanisms, or attempt counting. An attacker with valid primary credentials can exhaust the six-digit TOTP codespace within approximately 33 minutes to bypass two-factor authentication.

Successful exploitation results in a complete bypass of multi-factor authentication, granting an attacker full access to the victim's homeserver environment. Given the CVSS score of 8.1, this represents a high-severity risk that could lead to significant data exfiltration or total system compromise. The ability to bypass security controls undermines the integrity of the entire infrastructure managed by the orchestrator.

Immediate Action: Update Runtipi to version 4.8.1 or later to implement the necessary rate limiting and security controls on the TOTP verification endpoint.

Proactive Monitoring: Monitor authentication logs for anomalous spikes in traffic or high frequencies of requests targeting the /api/auth/verify-totp endpoint.

Compensating Controls: If immediate patching is not possible, implement strict IP-based rate limiting via a reverse proxy or Web Application Firewall (WAF) to block excessive requests to the affected API endpoint.

Public Exploit Available: Unknown.

The absence of rate limiting on a critical authentication endpoint presents a significant security flaw that enables unauthorized access to sensitive homeserver data. Organizations should prioritize updating to version 4.8.1 immediately to close this attack vector. Given the availability of proof-of-concept information, delay in remediation increases the risk of successful account takeover by malicious actors.