CVE-2026-32729 Runtipi has a TOTP two-factor authentication bypass via unrestricted brute-force on `/api/auth/verify-totp`
Attackers can bypass two-factor authentication by brute-forcing TOTP codes due to missing rate limiting, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-32729?
CVE-2026-32729 is a high-severity vulnerability in runtipi, published on 13 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Runtipi is a personal homeserver orchestrator. Prior to 4.8.1, The Runtipi /api/auth/verify-totp endpoint does not enforce any rate limiting, attempt counting, or account lockout mechanism. An attacker who has obtained a user's valid credentials (via phishing, credential stuffing, or data breach) can brute-force the 6-digit TOTP code to completely bypass two-factor authentication. The TOTP verification session persists for 24 hours (default cache TTL), providing an excessive window during which the full 1,000,000-code keyspace (000000–999999) can be exhausted. At practical request rates (~500 req/s), the attack completes in approximately 33 minutes in the worst case. This vulnerability is fixed in 4.8.1.
Which versions are affected by CVE-2026-32729?
It affects 1 product.
Products include Runtipi Runtipi.
How do I fix CVE-2026-32729?
No fix has been published for CVE-2026-32729 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-32729 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32729 exists.
Other vulnerabilities in runtipi
- CVE-2026-24129 Runtipi is Vulnerable to Authenticated Arbitrary Remote Code Execution
- CVE-2026-31881 Runtipi unauthenticated /api/auth/reset-password allows operator account takeover during active reset window
- CVE-2026-25116 Runtipi vulnerable to unauthenticated docker-compose.yml Overwrite via Path Traversal
Sources
Also known as GHSA-v6gf-frxm-567w.