Brute-force protection bypass on login endpoints in dataCycle-CORE (CVE-2026-32825)

dataCycle-CORE versions up to and including 25.07.3 accept unlimited password guesses against both the browser login endpoint (`/users/sign_in`) and the JSON API login endpoint (`/api/v4/auth/login`). Although Devise's lockable module is enabled, both lock and unlock strategies are explicitly disabled and no request throttling or rate-limiting layer is present, allowing continuous automated credential guessing without lockout. Successful exploitation yields a valid session cookie via the HTML flow or a JWT via the API flow, with the API endpoint being particularly suited to automation as it requires no CSRF token. Affected versions: - <= 25.07.3 We recommend updating to: 26.06.08. CVSS 7.3 · our assessment: this_week Reference: https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-736f-cqq3-ccgf Details: https://vuln.today/cve/CVE-2026-32825