PT-2026-25401 · Git+1 · Runtipi

Iconnnjka · Published 2026-03-13 · Updated 2026-03-18 · CVE-2026-32729

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Runtipi versions prior to 4.8.1

Description Runtipi is a personal homeserver orchestrator. The /api/auth/verify-totp endpoint lacks rate limiting, attempt counting, or account lockout mechanisms. An attacker with valid user credentials obtained through methods like phishing or credential stuffing can brute-force the 6-digit TOTP code, bypassing two-factor authentication. The TOTP verification session lasts 24 hours, allowing for exhaustive testing of the 1,000,000 possible codes. At a request rate of approximately 500 requests per second, a successful attack can take around 33 minutes. The vulnerable parameter is the TOTP code submitted to the /api/auth/verify-totp endpoint.

Recommendations Versions prior to 4.8.1 should be updated to version 4.8.1 or later.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-799

CWE-307

Related Identifiers

CVE-2026-32729

GHSA-V6GF-FRXM-567W

Affected Products

Runtipi

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32729.json · Exploit
• https://github.com/runtipi/runtipi/security/advisories/GHSA-v6gf-frxm-567w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32729 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32729 · Security Note
• https://twitter.com/cyberbivash/status/2032590051482234938 · Twitter Post
• https://t.me/CVEtracker/47396 · Telegram Post
• https://twitter.com/CVEnew/status/2032605813294924017 · Twitter Post
• https://twitter.com/TheHackerWire/status/2034416670350160343 · Twitter Post