CVE-2026-78655
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-78655 is a critical-severity Improper Restriction of Excessive Authentication Attempts (CWE-307) vulnerability. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Password Guessing (T1110.001); ranked at the 41th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-66120
Vulnerability Data
Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session. The POST handler on challenge_path keeps the failure count as tries…
more
inside the totp_pending record in the session, raising it on each rejected code and deleting the pending record once it reaches attempts, five by default. Punk::Session carries the session in a signed cookie unless the application declares a store, and keeps no server-side record, so an earlier value of the same session stays valid until the expiry stamped inside it. A client that saves the cookie before its failed attempts and presents it again gets the pending record back with its counter, and the limit never fires. The replayed record is accepted while its own expiry, pending_ttl seconds from the challenge and 300 by default, has not passed. Sessions declared with a store are not affected: the pending record and its counter then live server-side. The attempt limit does not bound guessing of the second factor, which is left to the per-address rate limit the plugin registers on the same path, 30 requests per 60 seconds.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 6 hardening rules · 3 OS baselines
V8.4.2
Mitigating Controls (NIST 800-53 r5) AI
Enforces access authorizations on the stored critical state data so unauthorized actors cannot read or modify it.
AC-7 directly enforces limits on consecutive failed logons, structurally blocking brute-force exploitation of the weakness.
Limits which subjects may access the location holding security-critical state, reducing the set of actors that can tamper with it.
Requires cryptographic or other protection of information at rest, directly blocking unauthorized external access to critical state.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Behavioral monitoring of authentication activity can detect excessive failed attempts after they occur.
Authentication enforcement directly includes lockout, throttling, and MFA policies that prevent brute-force attempts.
Enforcing least-privilege access permissions directly prevents unauthorized actors from reaching critical state data.
Protecting integrity of data-at-rest stops external tampering with stored security-critical state.
Network-level controls reduce the attack surface that would otherwise allow external modification of state.
Generating auth logs enables later detection or forensics but does not itself restrict attempts.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Access control policies directly limit who can read or modify security-critical state data.
Managing access rights prevents unauthorized actors from altering critical state stored externally.
Restricting privileged access rights reduces the chance that state data can be tampered with by unauthorized users.
Secure development practices can avoid placing critical state in externally writable locations.
Application security requirements can mandate that critical state not be stored in untrusted locations.
Secure architecture principles discourage external control of security-critical state.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248525 All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection. prevents CWE-642
Oracle Linux 9 (2 rules)
- V-271811 OL 9 /etc/passwd- file must have mode 0644 or less permissive to prevent unauthorized access. prevents CWE-642
- V-271756 OL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. prevents CWE-642
RHEL 7 (3 rules)
- V-204427 The Red Hat Enterprise Linux operating system must be configured to lock accounts for a minimum of 15 minutes after three unsuccessful logon attempts within a 15-minute timeframe. prevents CWE-307
- V-204428 The Red Hat Enterprise Linux operating system must lock the associated account after three unsuccessful root logon attempts are made within a 15-minute period. prevents CWE-307
- V-204627 SNMP community strings on the Red Hat Enterprise Linux operating system must be changed from the default. prevents CWE-642