A critical authentication bypass vulnerability in Punk::Plugin::TOTP allows attackers to compromise user accounts by successfully authenticating with their own recovery codes.

The vulnerability exists in the totp_use_recovery helper, which incorrectly compares user identifiers using Perl's integer coercion. Because non-numeric identifiers can coerce to zero, an attacker providing a valid recovery code of their own can bypass the ownership check and successfully authenticate as any target user, provided the attacker also knows the victim's password.

This vulnerability enables full account takeover for any user, leading to unauthorized access to sensitive data and critical system functions. Given the CVSS score of 9.8, the risk is extreme, as it effectively renders two-factor authentication useless for protected accounts. Organizations relying on this plugin face significant reputational damage and potential regulatory non-compliance due to the failure of primary security controls.

Immediate Action: Upgrade to Punk::Plugin::TOTP version 0.05 or later immediately to implement the corrected identifier comparison logic.

Proactive Monitoring: Review application access logs for unusual login patterns or multiple authentication failures followed by a successful login originating from unexpected IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to detect and block suspicious authentication attempts, although this may not fully prevent exploitation if the attacker possesses valid credentials.

Public Exploit Available: Unknown

The severity of this vulnerability necessitates an immediate update to the patched version of the plugin. Security teams should prioritize patching this component above other maintenance tasks, as the ability to bypass two-factor authentication constitutes a critical failure in the security posture of any application using this library.