Authentication Bypass in Plane Project Management Tool by Makeplane

CVE-2026-105638

What is CVE-2026-105638?

The Plane project management tool by Makeplane has a significant security flaw in its magic-code email login feature prior to version 1.4.0. This vulnerability stems from the use of a six-digit numeric One-Time Password (OTP) that offers only approximately 20 bits of entropy, making it susceptible to brute-force attacks. Additionally, the lack of a per-code failed-attempt counter allows repeated incorrect attempts without locking the email address or invalidating the Redis entry. The authentication mechanism does not implement any Django-level rate limiting measures, thus exposing the system to potential abuse. Users are strongly advised to upgrade to version 1.4.0 or later to mitigate these security risks.

References