Authen::TOTP versions before 0

CVE-2026-46473 affects Authen::TOTP for Perl before 0.1.1. The issue is not in TOTP math or verification; it is in *secret generation* during enrollment. Vulnerable releases generate new shared secrets with Perl's built-in rand, and 0.1.1 replaces that with Crypt::PRNG::random_string_from(). Practically, only secrets *created* by vulnerable versions are suspect; already-enrolled users remain at risk until those secrets are rotated or the users are re-enrolled.

The vendor's HIGH 7.5 score overstates operational risk by treating this like an unauthenticated network bug. In the real world, this is a library flaw that requires the target app to use the vulnerable module, rely on its default secret generation path, and expose an attacker to enough enrollment context to predict or narrow the generated secret. That is a meaningful security defect for MFA workflows, but it is *post-architecture* risk, not broad internet worm food.

Why this verdict

• Downward adjustment: requires actual library usage — the vulnerable component is a Perl module embedded in an app, so only deployments that both include Authen::TOTP and use its secret generator are exposed.
• Downward adjustment: poor external reachability — this is not broadly internet-discoverable like a VPN, appliance, or web server banner; exposure depends on internal package inventory, not internet census data.
• Downward adjustment: exploit chain needs more than the CVE — an attacker must model or constrain Perl rand output around enrollment time, and no authoritative public PoC or mass exploitation evidence was found.
• Downward adjustment: blast radius is account-scoped — success compromises TOTP seeds for affected enrollments, not the host or application stack directly.
• Upward adjustment: it targets MFA trust — if a high-value internet-facing application uses this module for user enrollment, the bug can silently weaken second-factor protection for newly enrolled accounts.

Why not higher?

It is not higher because the vendor vector treats the bug as if the network itself exposes a one-click exploit path. In practice, the attacker usually needs a specific Perl application, the vulnerable enrollment flow, enough context to predict secrets, and then another path to benefit from the recovered seed. That is too much compounded friction for HIGH or CRITICAL.

Why not lower?

It is not lower because this can directly weaken MFA, and MFA seed quality is a security boundary, not a cosmetic issue. If the vulnerable generator issued secrets for externally accessible user accounts, successful prediction can translate into real account compromise rather than a harmless code-quality defect.

1. Inventory every consumer of Authen::TOTP — Use SBOMs, SCA, package inventory, or host checks to identify where the module is installed and whether the application calls module-generated enrollment secrets. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but do the inventory early so you can separate dormant libraries from real MFA exposure.
2. Prioritize internet-facing enrollment workflows — Review customer, partner, admin, and workforce portals that let users enroll or reset TOTP. If those apps used vulnerable versions to mint secrets, plan re-enrollment or secret rotation for impacted accounts within the same 365-day remediation window, with privileged and externally reachable populations first.
3. Enforce stronger MFA for privileged users — Move admins and high-impact roles to phishing-resistant methods such as WebAuthn/FIDO2 where possible, so a predictable TOTP seed is not the last line of defense. This is risk reduction, not a substitute for patching, and it should be rolled into the normal remediation program for this MEDIUM issue.
4. Monitor MFA enrollment and validation anomalies — Alert on bursts of TOTP enrollments, unusual reset activity, repeated OTP failures, and successful logins from new devices right after enrollment changes. That will not fix the bug, but it gives you a chance to catch exploitation attempts while you work through the remediation window.

Run this on the target host or a build/CI worker that has access to the same Perl runtime as the application. Invoke it as python3 check_cve_2026_46473.py or python3 check_cve_2026_46473.py /usr/bin/perl; it needs only normal user rights and reads the installed Authen::TOTP version via Perl.

#!/usr/bin/env python3
# Check for CVE-2026-46473 in installed Perl Authen::TOTP
# Usage:
#   python3 check_cve_2026_46473.py
#   python3 check_cve_2026_46473.py /path/to/perl
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import re
import sys
import subprocess
from shutil import which

FIXED = (0, 1, 1)


def parse_version(v):
    m = re.match(r'^\s*v?(\d+)\.(\d+)\.(\d+)\s*$', v)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def main():
    perl = sys.argv[1] if len(sys.argv) > 1 else (which('perl') or 'perl')

    cmd = [
        perl,
        '-MAuthen::TOTP',
        '-e',
        'print defined($Authen::TOTP::VERSION) ? $Authen::TOTP::VERSION : "UNKNOWN"'
    ]

    try:
        proc = subprocess.run(cmd, capture_output=True, text=True, timeout=15)
    except FileNotFoundError:
        print('UNKNOWN: perl not found')
        sys.exit(2)
    except Exception as e:
        print(f'UNKNOWN: failed to execute perl: {e}')
        sys.exit(2)

    if proc.returncode != 0:
        stderr = (proc.stderr or '').strip()
        if 'Can\'t locate Authen/TOTP.pm' in stderr:
            print('UNKNOWN: Authen::TOTP not installed in this Perl runtime')
        else:
            print(f'UNKNOWN: perl returned {proc.returncode}: {stderr}')
        sys.exit(2)

    version = (proc.stdout or '').strip()
    parsed = parse_version(version)
    if not parsed:
        print(f'UNKNOWN: could not parse Authen::TOTP version: {version!r}')
        sys.exit(2)

    if parsed < FIXED:
        print(f'VULNERABLE: Authen::TOTP {version} < 0.1.1')
        sys.exit(1)
    else:
        print(f'PATCHED: Authen::TOTP {version} >= 0.1.1')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. oss-security disclosure
2. MetaCPAN module documentation
3. MetaCPAN changelog
4. Upstream patch commit
5. MetaCPAN 0.1.1 release
6. Upstream repository
7. RFC 6238 TOTP reference