Executive Summary

This vulnerability exists in Runtipi versions prior to 4.8.1 in the /api/auth/verify-totp endpoint. The endpoint does not enforce rate limiting, attempt counting, or account lockout mechanisms for verifying the 6-digit Time-based One-Time Password (TOTP) codes.

An attacker who has obtained a user's valid credentials (for example, through phishing, credential stuffing, or data breaches) can brute-force the 6-digit TOTP code to bypass two-factor authentication completely.

Because the TOTP verification session persists for 24 hours by default, the attacker has an excessive window to try all possible 1,000,000 codes (from 000000 to 999999). At practical request rates of about 500 requests per second, the attacker can exhaust the entire code space in approximately 33 minutes in the worst case.

This vulnerability was fixed in Runtipi version 4.8.1.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker who already has valid user credentials to bypass two-factor authentication by brute-forcing the TOTP code.

As a result, the attacker can gain unauthorized access to the affected user's account, potentially compromising sensitive personal or system data managed by the Runtipi homeserver.

Because the attack can be completed in a relatively short time (around 33 minutes), it significantly reduces the security benefits of two-factor authentication.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed in Runtipi version 4.8.1. The immediate step to mitigate this vulnerability is to upgrade Runtipi to version 4.8.1 or later.

This update enforces rate limiting, attempt counting, and account lockout mechanisms on the /api/auth/verify-totp endpoint, preventing brute-force attacks on the 6-digit TOTP code.

Useful 0 Not Useful 0