CVE-2026-73529Plainpad Missing Rate Limiting via POST /v1/sessions
Updated under an hour ago ()
Does this affect you?
It affects alextselegidis plainpad. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Plainpad through 1.1.1, fixed in commit d3823fc, contains a missing rate limiting vulnerability that allows unauthenticated attackers to send unbounded login requests to the POST /v1/sessions endpoint due to dead code in App\Http\Kernel.php that is never instantiated under the Laravel 11+ skeleton, leaving the API throttle configuration unattached to any route. Attackers can exploit this by sending unlimited credential attempts with no lockout or CAPTCHA enforcement, and additionally trigger CPU exhaustion by forcing repeated bcrypt comparisons on each request.
- CVSS
- 5.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weakness (CWE)
- CWE-307
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Deferred
- Record last updated
- Aug 18, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
alextselegidis plainpad alextselegidis:plainpad (from the name) | through 1.1.1; d3823fc595b5d8f842a6fd7dfe49b7852a10fdac not affected | CNA record |
References
- https://github.com/alextselegidis/plainpad/commit/d3823fc595b5d8f842a6fd7dfe49b7852a10fdacpatch
- https://www.vulncheck.com/advisories/plainpad-missing-rate-limiting-via-post-v1-sessionsthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.