CVE-2026-72584
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A time-of-check/time-of-use (TOCTOU) race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on the account recovery flow, enabling brute-force attacks on 6-digit OTP codes.
Risk Assessment
An attacker can take over user accounts by cracking OTP codes, potentially leading to unauthorized access to data and system integrity compromise.
Recommendation
Update fastschema to a patched version. Additionally, consider implementing additional security mechanisms such as account lockout after several failed attempts.
Original NVD description (English source)
A time-of-check/time-of-use (TOCTOU) race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on the account recovery flow, enabling brute-force attacks on 6-digit OTP codes.