CyberRota Analysis
AI-GeneratedA time-of-check/time-of-use (TOCTOU) race condition in fastschema versions up to 0.15.1 allows unauthenticated remote attackers to bypass the one-time password (OTP) attempt limit during account recovery, facilitating brute-force attacks on 6-digit OTP codes. This vulnerability arises from non-atomic operations in the verifyOTPSession function, which can lead to concurrent requests exploiting the same attempt count. Organizations using affected versions should prioritize remediation to protect against potential unauthorized access to user accounts.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A time-of-check/time-of-use (TOCTOU) race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on the account recovery flow, enabling brute-force attacks on 6-digit OTP codes.