CVE-2026-126571

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-126571
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126571.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-126571
Aliases
  • GHSA-3mq5-m2qg-fqhq
Published
2026-11-11T02:36:06Z
Modified
2026-11-12T02:48:34Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Padloc 4.0.0 before 4.3.1 Email MFA Code Brute Force via retrieveMFAToken
Details

Padloc 4.0.0 before 4.3.1 contains an authentication bypass vulnerability in the legacy retrieveMFAToken handler that never counts wrong email verification codes toward the attempt limit. Unauthenticated attackers knowing a victim's email can brute force the 6-digit code to obtain verification tokens usable in signup, login and account recovery flows.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-307"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126571.json"
}
References

Affected packages

Git / github.com/padloc/padloc

Affected ranges

Type
GIT
Repo
https://github.com/padloc/padloc
Events
Introduced
5af036079de201e966882368f00cf8e1da91f3aa
Fixed
3288ce48034ded2a31be03805b607e8f708416df
Fixed
26f292515fe623826070454872f9cee08b756544
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "4.0.0"
                },
                {
                    "fixed": "4.3.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "26f292515fe623826070454872f9cee08b756544"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

Other
padloc-staging-channel
v4.*
v4.0.0
v4.0.2
v4.1.0
v4.2.0
v4.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126571.json"