PT-2026-25401 · Git+1 · Runtipi

Iconnnjka · Publicado 2026-03-13 · Atualizado 2026-03-18 · CVE-2026-32729

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Runtipi versions prior to 4.8.1

Description Runtipi is a personal homeserver orchestrator. The /api/auth/verify-totp endpoint lacks rate limiting, attempt counting, or account lockout mechanisms. An attacker with valid user credentials obtained through methods like phishing or credential stuffing can brute-force the 6-digit TOTP code, bypassing two-factor authentication. The TOTP verification session lasts 24 hours, allowing for exhaustive testing of the 1,000,000 possible codes. At a request rate of approximately 500 requests per second, a successful attack can take around 33 minutes. The vulnerable parameter is the TOTP code submitted to the /api/auth/verify-totp endpoint.

Recommendations Versions prior to 4.8.1 should be updated to version 4.8.1 or later.

Exploit

Correção

Improper Restriction of Excessive Authentication Attempts

Enumeração de Fraquezas

CWE-799

CWE-307

Identificadores relacionados

CVE-2026-32729

GHSA-V6GF-FRXM-567W

Produtos afetados

Runtipi

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32729.json · Exploit
• https://github.com/runtipi/runtipi/security/advisories/GHSA-v6gf-frxm-567w · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-32729 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32729 · Nota de Segurança
• https://twitter.com/cyberbivash/status/2032590051482234938 · Publicação no Twitter
• https://t.me/CVEtracker/47396 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2032605813294924017 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2034416670350160343 · Publicação no Twitter