CVE-2026-73529

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-73529

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73529.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-73529

Published

2026-08-18T19:10:33Z

Modified

2026-08-20T03:55:11Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Plainpad Missing Rate Limiting via POST /v1/sessions

Details

Plainpad through 1.1.1, fixed in commit d3823fc, contains a missing rate limiting vulnerability that allows unauthenticated attackers to send unbounded login requests to the POST /v1/sessions endpoint due to dead code in App\Http\Kernel.php that is never instantiated under the Laravel 11+ skeleton, leaving the API throttle configuration unattached to any route. Attackers can exploit this by sending unlimited credential attempts with no lockout or CAPTCHA enforcement, and additionally trigger CPU exhaustion by forcing repeated bcrypt comparisons on each request.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-307"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73529.json"
}

References

Affected packages

Git / github.com/alextselegidis/plainpad

Affected ranges

Type

GIT

Repo

https://github.com/alextselegidis/plainpad

Events

Introduced

Fixed

ab27ad80801fdc8a84a65251eb19fa15c529fe97

Fixed

d3823fc595b5d8f842a6fd7dfe49b7852a10fdac

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.1.1"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.0.0

1.0.0-alpha.1

1.0.0-beta.1

1.0.0-beta.2

1.0.0-beta.3

1.0.0-beta.4

1.1.0

1.1.0-alpha.1

1.1.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73529.json"