EUVD-2026-38239
GHSA-hc8r-p4jw-p6fr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the hard prerequisite of a compromised target password; C:L/I:L because account access grants read and limited write within that account's AIL scope.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
Lifecycle Timeline
2DescriptionCVE.org
AIL did not restrict repeated failed attempts to verify a two-factor authentication (OTP) code. An attacker who had reached the 2FA verification step, such as after successfully completing the password-authentication stage, could submit an unlimited number of OTP guesses. This could enable brute-force guessing of a valid code and bypass the intended second authentication factor, resulting in unauthorized account access.
The patch introduces per-user failed-OTP tracking, blocks verification after 30 failed attempts for one hour, clears the counter after a successful OTP verification, and provides administrator recovery actions to purge affected lockouts.
AnalysisAI
Unlimited OTP brute-force against AIL Framework's two-factor authentication endpoint allows an attacker who already possesses a valid account password to bypass the second authentication factor entirely and gain unauthorized account access. The verify_2fa() route accepted an unbounded number of OTP submissions without incrementing a failure counter or enforcing a lockout, and the implementation uses counter-based HOTP rather than time-limited TOTP, removing the time-window throttle that would otherwise constrain brute-force speed. No public exploit code or CISA KEV listing exists at time of analysis, but the prerequisite of a valid password - obtainable via phishing or credential dumps - makes this a realistic threat against any AIL deployment where 2FA is meant to serve as a meaningful access boundary.
Technical ContextAI
AIL Framework (cpe:2.3:a:ail_project:ail_framework:*:*:*:*:*:*:*:*) is an open-source threat intelligence analysis platform maintained by CIRCL. Its authentication flow is two-stage: username/password verification followed by OTP verification in the verify_2fa() Flask blueprint route. The OTP implementation uses HOTP (counter-based one-time passwords), evidenced by references to get_htop_counter() in the patch diff - a notable detail because HOTP codes remain valid until consumed, unlike TOTP codes that expire every 30 seconds, making time-unlimited brute-forcing more tractable. CWE-307 (Improper Restriction of Excessive Authentication Attempts) is the precise root cause: the verify_2fa() function incremented no failure counter and checked no threshold before each guess. The patch remedies this by storing a per-user failure counter in Redis under the key failed_otp_user_id:{user_id}, enforcing a hard lockout after 30 failures with a 3600-second TTL, clearing the counter on successful verification, and adding administrator-only endpoints to purge individual or global OTP lockouts.
RemediationAI
The primary remediation is to update AIL Framework to a commit at or beyond d3a394fe68fd5aeee86f3a3c91d4a0350f91e974, available at https://github.com/ail-project/ail-framework/commit/d3a394fe68fd5aeee86f3a3c91d4a0350f91e974. A specific tagged release version incorporating this fix has not been independently confirmed - administrators should verify their deployed commit hash against this fix. The patch introduces per-user OTP lockout after 30 failed attempts (1-hour block), automatic counter reset on successful OTP entry, and two administrator recovery endpoints: /settings/users/purge_failed_login to clear all login brute-force counters globally and /settings/user/purge_otp_timeout?user_id={id} to clear an individual user's OTP lockout. As a compensating control prior to patching, restricting network access to the AIL web interface to trusted IP ranges or a VPN reduces attacker reach to the OTP endpoint without eliminating the vulnerability. Monitoring Redis or application access logs for rapid sequential failed_otp_user_id increments can provide early detection of active brute-force attempts.
More in Ail Framework
View allStored cross-site scripting in AIL Framework <6.8 allows authenticated high-privilege attackers to inject malicious Java
Authenticated path traversal in AIL Framework (CIRCL's Analysis Information Leak threat-intel platform) lets a low-privi
Global.py in AIL framework 2.8 allows path traversal. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
Path traversal in AIL Framework's PDF object handling lets an authenticated user read files outside the intended PDF sto
Non-blind SSRF in AIL Framework's crawler submission interface allows low-privileged authenticated users to pivot throug
Path traversal in AIL Framework's `/objects/item/diff` endpoint exposes gzip-compressed server-side files to authenticat
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today