Recipes CVE-2026-33152

Tandoor Recipes versions prior to 2.6.0 with Django REST Framework BasicAuthentication enabled (default configuration). Remote unauthenticated attacker can target any API endpoint accepting Authorization: Basic headers. No rate limiting or account lockout protections apply to API authentication, enabling unlimited credential brute-force attempts.

The CVSS score of 9.1 (Critical) reflects network-based exploitation requiring no privileges or user interaction (AV:N/AC:L/PR:N/UI:N) with high confidentiality and integrity impact. SSVC analysis confirms the attack is automatable with total technical impact and publicly available exploit code exists, elevating practical risk significantly. The combination of POC availability, zero authentication requirements, and automatable exploitation makes this a high-priority vulnerability despite absence from CISA KEV. Real-world risk is substantial because credential stuffing attacks are routinely automated at scale by threat actors, and the unlimited attempt window (no rate limiting, no lockout) drastically reduces time-to-compromise for weak passwords. Organizations running Tandoor Recipes exposed to untrusted networks face immediate risk of account takeover, particularly for installations with Internet exposure or shared hosting environments where IP-based controls are ineffective.

An attacker identifies a Tandoor Recipes installation exposed to the Internet and enumerates valid usernames through registration attempts, password reset forms, or predictable naming conventions. Using publicly available exploit code targeting API endpoints with Authorization: Basic headers, the attacker launches a distributed credential stuffing campaign from multiple IPs, cycling through common passwords and breached credential databases at thousands of attempts per second with zero rate limiting. Within minutes to hours depending on password strength, the attacker gains authenticated access to user accounts, potentially accessing private recipes, personal meal plans, and shopping lists containing dietary restrictions or household information.