EUVD-2026-59771
GHSA-8r5p-64x9-63r7
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated endpoint with AC:H per disclosure narrative; impact is confined to low confidentiality via credential recovery with no integrity or availability consequence.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability has been found in mangroup dtale up to 3.22.0. This issue affects the function Login of the file dtale/auth.py of the component Login Endpoint. Such manipulation leads to improper restriction of excessive authentication attempts. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Brute-force authentication bypass in dtale (man-group) up to version 3.22.0 allows remote attackers to submit unlimited login attempts against the Login Endpoint in dtale/auth.py due to the absence of rate limiting or account lockout controls (CWE-307). The CVSS 4.0 score of 2.9 reflects high attack complexity and limited confidentiality impact, consistent with the description's characterization of exploitation as difficult. Publicly available exploit code exists (CVSS 4.0 E:P modifier), and no vendor patch has been released - the project has not responded to the coordinated disclosure via GitHub issue.
Technical ContextAI
dtale is a Python web application (typically Flask-based) that provides an interactive GUI for visualizing and analyzing pandas DataFrames, widely used in data science development workflows. The vulnerability resides in the Login function within dtale/auth.py, which governs the optional authentication layer for the web interface. CWE-307 (Improper Restriction of Excessive Authentication Attempts) identifies the root cause as the absence of defensive mechanisms such as account lockout thresholds, CAPTCHA challenges, exponential backoff, or per-IP request throttling on the login endpoint. Without these controls, an attacker can submit credential pairs programmatically at machine speed without triggering any blocking response. No CPE strings were provided in the intelligence data, so the affected product scope is based solely on VulDB and NVD reporting for dtale versions up to 3.22.0.
RemediationAI
No vendor-released patch has been identified at time of analysis - the project was notified via GitHub issue (https://github.com/man-group/dtale/issues/961) but has not responded. As the primary compensating control, restrict network access to dtale instances by binding only to localhost or internal network interfaces and placing the service behind a VPN; dtale is designed for development use and should not be internet-exposed. If network restriction is not feasible, deploy a reverse proxy (e.g., nginx with limit_req_zone, or Apache with mod_ratelimit) in front of dtale to enforce per-IP login attempt throttling - note this adds operational complexity and may affect legitimate users on shared IPs. Using strong, randomly generated passwords increases the cost of brute-force attacks but does not eliminate the vulnerability. If authentication is not operationally required, disabling dtale's auth module and relying solely on network-level access control removes the exposed endpoint entirely, though this eliminates the authentication layer as a defense-in-depth measure. Monitor https://github.com/man-group/dtale/issues/961 for vendor response and patch release.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today