What is the CVSS score of CVE-2026-51788?

CVE-2026-51788 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of cleverange_auth are affected by CVE-2026-51788?

cleverange_auth v0.1.10, a Python authentication library distributed via PyPI, contains an uncontrolled resource consumption flaw allowing remote, unauthenticated attackers to trigger denial of…

How to fix or mitigate CVE-2026-51788?

Within 24 hours, identify all systems running cleverange_auth v0.1.10 and assess their criticality. Within 7 days, implement rate limiting on the account_verification endpoint, deploy WAF rules to throttle suspicious request patterns, enable resource-exhaustion alerting (CPU, memory, connections), and isolate the affected service from untrusted networks if possible. Within 30 days, migrate to an alternative actively-maintained authentication library or fork cleverange_auth internally to apply a hardened rate-limiting fix before production deployment.

cleverange_auth CVE-2026-51788

EUVD-2026-69392 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-09-01 mitre

GHSA-hc7j-fw9h-36wg

Denial Of Service

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated network DoS with no confidentiality or integrity impact; AC:L consistent with SSVC partial-automatable finding despite non-trivial repeatability.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Sep 03, 2026 - 17:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 03, 2026 - 17:22 vuln.today

cvss_changed

Severity Changed

Sep 03, 2026 - 17:22 NVD

LOW HIGH

CVSS changed

Sep 03, 2026 - 17:22 NVD

3.1 (LOW) 7.5 (HIGH)

Metadata Corrected

Sep 03, 2026 - 15:40 vuln.today

tag: N A removed

Analysis Generated

Sep 03, 2026 - 15:26 vuln.today

CVE Published

Sep 01, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in cleverange_auth v.0.1.10 allows a remote attacker to cause a denial of service via the account_verification function and the accounts/models.py component

AnalysisAI

Uncontrolled resource consumption in cleverange_auth v0.1.10 allows remote unauthenticated attackers to exhaust server resources and cause a denial of service by invoking the account_verification function exposed through the accounts/models.py component. The PyPI-distributed Python authentication library is affected in its only publicly released version (0.1.10), and a public disclosure repository exists on GitHub. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No special conditions are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N): exploitation is remote and unauthenticated against any application that has deployed cleverange_auth v0.1.10 and exposes the account_verification function over a network-reachable HTTP interface. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 7.5 score reflects unauthenticated, network-reachable availability impact and is mechanically consistent with the vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.