Skip to main content

Plainpad EUVDEUVD-2026-61159

| CVE-2026-73529 MEDIUM
Improper Restriction of Excessive Authentication Attempts (CWE-307)
2026-08-18 disclosure@vulncheck.com GHSA-9fxw-r4jg-3hq3
PHP Information Disclosure
6.9
CVSS 4.0 · Vendor: vulncheck
Share

Severity by source

Vendor (vulncheck) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Network-reachable with no authentication or prerequisites; availability impact limited to CPU exhaustion from unbounded bcrypt calls; missing rate limit itself causes no direct confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Source Code Evidence Fetched
Aug 18, 2026 - 20:43 vuln.today
Analysis Generated
Aug 18, 2026 - 20:43 vuln.today

DescriptionCVE.org

Plainpad through 1.1.1, fixed in commit d3823fc, contains a missing rate limiting vulnerability that allows unauthenticated attackers to send unbounded login requests to the POST /v1/sessions endpoint due to dead code in App\Http\Kernel.php that is never instantiated under the Laravel 11+ skeleton, leaving the API throttle configuration unattached to any route. Attackers can exploit this by sending unlimited credential attempts with no lockout or CAPTCHA enforcement, and additionally trigger CPU exhaustion by forcing repeated bcrypt comparisons on each request.

AnalysisAI

Missing rate limiting on the POST /v1/sessions login endpoint in Plainpad through 1.1.1 allows unauthenticated remote attackers to submit unlimited credential attempts with no lockout, enabling both credential stuffing and a CPU exhaustion denial-of-service via repeated bcrypt comparisons. The flaw originates from a Laravel framework version mismatch: the throttle middleware was defined in App\Http\Kernel.php, which is dead code never instantiated by the Laravel 11+ bootstrap model, leaving the API route group entirely unthrottled. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify exposed Plainpad instance via HTTP fingerprinting
Delivery
Send unlimited POST /v1/sessions requests with harvested credential pairs
Exploit
Bypass absent rate limiter (no lockout, no CAPTCHA)
Execution
Force bcrypt comparison on each request exhausting CPU
Impact
Obtain valid session on credential match or degrade service availability
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No special conditions are required - POST /v1/sessions is a publicly accessible endpoint by design, intended to accept unauthenticated login attempts. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully remote, unauthenticated exploitation with no special conditions and no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a list of email addresses and a credential dump from a prior breach submits automated POST requests to /v1/sessions in a credential stuffing loop; with no rate limit or lockout enforced, tens of thousands of attempts per minute are feasible using standard tooling such as ffuf or hydra. Simultaneously, the bcrypt comparison triggered on each attempt drives sustained CPU utilization on the server, potentially degrading or denying service to legitimate users. …
Remediation Upstream fix available via commit d3823fc595b5d8f842a6fd7dfe49b7852a10fdac (https://github.com/alextselegidis/plainpad/commit/d3823fc595b5d8f842a6fd7dfe49b7852a10fdac); a released patched version number has not been independently confirmed from available data. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in PHP

View all
CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2012-1823 CRITICAL POC
9.8 May 11

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
CVE-2016-1555 CRITICAL POC
9.8 Apr 21

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
CVE-2018-11138 CRITICAL POC
9.8 May 31

The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
CVE-2024-11680 CRITICAL POC
9.8 Nov 26

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
CVE-2025-49113 CRITICAL POC
9.9 Jun 02

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
CVE-2017-9841 CRITICAL POC
9.8 Jun 27

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
CVE-2025-0108 HIGH POC
8.8 Feb 12

Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers

CVE-2021-25298 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2021-25296 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2013-4983 CRITICAL POC
10.0 Sep 10

The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
CVE-2023-6553 CRITICAL POC
9.8 Dec 15

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1

Same weakness CWE-307 – Improper Restriction of Excessive Authentication Attempts

View all
CVE-2022-33106 CRITICAL POC
9.8
CVE-2026-44596 CRITICAL POC
9.8
CVE-2024-43042 CRITICAL POC
9.8
CVE-2024-39225 CRITICAL POC
9.8
CVE-2024-24767 CRITICAL POC
9.8
CVE-2023-6272 CRITICAL POC
9.8
CVE-2023-6756 CRITICAL POC
9.8
CVE-2023-49443 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-61159 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy