CVE-2026-103977
FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts
- Published
- Oct 14, 2026
- Updated
- Oct 14, 2026
- Assigning CNA
- GitHub_M
- Evidence observed
- Oct 3, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NLow · next 30 days
- Percentile
- 37.5%
- Model date
- Oct 15, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise stores failed TOTP verification attempts in $_SESSION. An attacker who already possesses a target account's valid primary credential can restart the login workflow in a new session and restore the second-factor attempt allowance, permitting continued online TOTP guessing beyond the intended five-attempt limit. The pending-login TOTP handlers did not share a durable account-wide limit. This issue is fixed in version 3.23.0.
Sources
- CVE-2026-103977Informational
Session-scoped TOTP rate limiting permits repeated verification attempts
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.