EUVD-2026-60580
GHSA-2ccr-52p8-6754
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated endpoint (AV:N, PR:N), but credential success depends on weak target passwords beyond attacker control (AC:H); impact limited to partial confidentiality with no integrity or availability consequences.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been made public and could be used. Upgrading to version 0.33.0 is sufficient to fix this issue. The patch is identified as f7d042971d0d2bcc7119654830cf1eb93eabbf24. It is advisable to upgrade the affected component.
AnalysisAI
Unlimited authentication attempts against the karakeep login endpoint (apps/web/server/auth.ts) in versions up to 0.32.0 enable remote credential brute-forcing due to a missing rate-limiting guard on the NextAuth authorize function (CWE-307). The CVSS 4.0 score of 2.9 with AC:H reflects that successful exploitation depends on the target account holding a guessable password - a condition outside the attacker's direct control. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The login endpoint is network-reachable and requires no prior authentication or session state, making the attack surface accessible to any remote actor (PR:N in both CVSS assessments). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base vector AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N yields a score of 2.9, placing this at the low end of severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker enumerates a publicly exposed karakeep instance and identifies a registered user's email address from a prior data breach or public profile. Using an automated credential-stuffing tool seeded with commonly leaked passwords, the attacker submits thousands of unauthenticated POST requests to the login endpoint with no server-side throttle to interrupt them. … |
| Remediation | Upgrade to karakeep version 0.33.0, available at https://github.com/karakeep-app/karakeep/releases/tag/mcp/v0.33.0 (patch commit f7d042971d0d2bcc7119654830cf1eb93eabbf24). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored cross-site scripting in Karakeep 0.30.0 allows remote attackers to execute arbitrary JavaScript in users' browser
Server-side request forgery in Karakeep self-hosted bookmark manager versions prior to 0.32.0 allows authenticated users
OAuth Sign-In bypass in Karakeep up to version 0.32.0 allows unauthenticated remote attackers to subvert the authenticat
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today