CVE-2026-32729 - Vulnerability Analysis

Overview

Runtipi < 4.8.1 contains a broken authentication caused by lack of rate limiting and account lockout on /api/auth/verify-totp endpoint, letting attackers with valid credentials brute-force 2FA TOTP codes, exploit requires valid user credentials.

Severity & Score

Impact

Attackers with valid credentials can bypass two-factor authentication by brute-forcing TOTP codes, leading to full account compromise.

Mitigation

Upgrade to version 4.8.1 or later.

References

• https://github.com/runtipi/runtipi/security/advisories/GHSA-v6gf-frxm-567w

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 16, 2026

🟠 CVE-2026-32729 - High (8.1) Runtipi is a personal homeserver orchestrator. Prior to 4.8.1, The Runtipi /api/auth/verify-totp endpoint does not enforce any rate limiting, attempt counting, or account lockout mechanism. An attacker who has obtained a user's valid credentials (... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32729/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner