What is the CVSS score of CVE-2026-33152?

CVE-2026-33152 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Python are affected by CVE-2026-33152?

Tandoor Recipes versions before 2.6.0 contain a critical authentication bypass vulnerability that allows attackers to brute-force user credentials through API endpoints while evading rate-limiting…. A patch is available.

How to fix or mitigate CVE-2026-33152?

Within 24 hours: Identify all instances of Tandoor Recipes in your environment and document current versions. Within 7 days: upgrade all affected deployments to Tandoor Recipes version 2.6.0 or later; if immediate upgrade is not feasible, implement API-level rate limiting (max 5 authentication attempts per minute per IP) at reverse proxy or WAF layer. Within 30 days: conduct credential audit for all users in affected systems and require password reset for accounts not changed since vulnerability disclosure date.

Python CVE-2026-33152

EUVD-2026-16315 CRITICAL

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-03-26 GitHub_M

Python Information Disclosure

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:48 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.6.0

EUVD ID Assigned

Mar 26, 2026 - 19:16 euvd

EUVD-2026-16315

Analysis Generated

Mar 26, 2026 - 19:16 vuln.today

CVE Published

Mar 26, 2026 - 19:07 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, Tandoor Recipes configures Django REST Framework with BasicAuthentication as one of the default authentication backends. The AllAuth rate limiting configuration (ACCOUNT_RATE_LIMITS: login: 5/m/ip) only applies to the HTML-based login endpoint at /accounts/login/. Any API endpoint that accepts authenticated requests can be targeted via Authorization: Basic headers with zero rate limiting, zero account lockout, and unlimited attempts. An attacker can perform high-speed password guessing against any known username. Version 2.6.0 patches the issue.

AnalysisAI

Tandoor Recipes versions prior to 2.6.0 allow unlimited brute-force password guessing attacks against any known username through API endpoints accepting BasicAuthentication headers. While Django AllAuth rate limiting protects the HTML login form (5 attempts per minute per IP), API endpoints completely bypass these controls, enabling high-speed credential stuffing with no account lockout. A proof-of-concept exploit exists and the attack is automatable per SSVC analysis, though no active exploitation is confirmed in CISA KEV.

Technical ContextAI

Tandoor Recipes (cpe:2.3:a:tandoorrecipes:recipes) is a Python-based Django application that configures Django REST Framework with BasicAuthentication as a default authentication backend. The vulnerability stems from CWE-307 (Improper Restriction of Excessive Authentication Attempts), where rate limiting implemented through Django AllAuth (ACCOUNT_RATE_LIMITS: login: 5/m/ip) only applies to traditional form-based authentication endpoints at /accounts/login/. API endpoints accepting HTTP Basic Authentication headers through the Authorization header remain unprotected, creating a parallel authentication path with no brute-force controls. This architectural flaw separates rate limiting enforcement from the authentication mechanism itself, allowing attackers to bypass protections by targeting different endpoints using the same credentials.

RemediationAI

Upgrade Tandoor Recipes to version 2.6.0 or later, which patches the BasicAuthentication brute-force vulnerability. The patched release is available at https://github.com/TandoorRecipes/recipes/releases/tag/2.6.0 and addresses the issue by removing or properly rate-limiting BasicAuthentication on API endpoints. Until patching is feasible, implement defense-in-depth controls including network-level rate limiting via reverse proxy (nginx, HAProxy) to restrict authentication attempts per source IP, enforce strong password policies to increase brute-force difficulty, deploy IP allowlisting if the application serves only known networks, monitor authentication logs for suspicious patterns indicating credential stuffing, and consider disabling API endpoints if not required for operational use. Consult the GitHub security advisory at https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-7m7c-jjqc-r522 for additional vendor guidance.