Can attackers bypass FileRise TOTP limits to guess second factors?

The short version

• FileRise versions before 3.23.0 contain a high-severity authentication bypass flaw.
• Valid primary credential holders can circumvent the five-attempt TOTP limit.
• Version 3.23.0 includes the fix for this session-handling error.

The details

FileRise, a self-hosted web-based file manager supporting multi-file upload and batch operations, contains a high-severity authentication flaw in versions older than 3.23.0. According to the NVD record, the issue allows an attacker possessing a target account's valid primary credential to restart the login workflow. By initiating a new session, the attacker restores the second-factor attempt allowance. This action permits continued online TOTP guessing beyond the intended five-attempt limit. The pending-login TOTP handlers failed to share a durable account-wide limit, relying instead on session storage. This issue is fixed in version 3.23.0.

The context

The vulnerability, tracked as CVE-2026-103977, is rated CVSS 8.1 HIGH. It maps to CWE-307 (Improper Restriction of Excessive Authentication Attempts) and CWE-841 (Improper Enforcement of Behavioral Semantic Rule). The flaw specifically targets the session management logic for two-factor authentication. Without an account-wide lockout mechanism, the system treats each new session as a fresh start for TOTP attempts, effectively nullifying the rate-limiting protection for accounts with compromised primary passwords.

Next steps

Administrators using FileRise should verify their current version immediately. If running a version prior to 3.23.0, the issue is fixed in version 3.23.0. Teams should also review login logs for accounts with multiple failed TOTP attempts across different sessions, which may indicate exploitation of this specific bypass mechanism.

What defenders should look for

Security operations teams should monitor for anomalous login patterns involving the same user account. Look for sequences of failed second-factor attempts that reset after a new session is established, rather than triggering a persistent lockout. Check whether authentication logs show multiple distinct session IDs associated with a single primary credential during a short timeframe.

Teams usually implement account-wide rate limiting for second factors to prevent this. First containment moves include forcing password resets for affected accounts and temporarily disabling login for users showing repeated TOTP failures across sessions. Review session management configurations to ensure attempt counters persist across session renewals.

What to do and how to stay safe: FileRise

• Verify your FileRise version and upgrade to 3.23.0 if you are running an older release.
• Monitor authentication logs for patterns of failed TOTP attempts followed by new session initiations.
• Enforce account-wide rate limiting for two-factor authentication to prevent session-based resets.
• Review session management configurations to ensure attempt counters persist across session renewals.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-103977?

The vulnerability has a CVSS score of 8.1, which is rated as HIGH severity.

Which FileRise versions are affected by this flaw?

All versions of FileRise prior to 3.23.0 are affected by this authentication bypass issue.

How does an attacker exploit this vulnerability?

An attacker with a valid primary credential restarts the login workflow in a new session to reset the TOTP attempt limit.