Authentication Bypass in Padloc Affects User Security

CVE-2026-126571

What is CVE-2026-126571?

An authentication bypass vulnerability exists in Padloc versions prior to 4.3.1. The flaw is rooted in the legacy retrieveMFAToken handler, which fails to properly enforce limits on incorrect email verification code entries. This issue allows unauthorized attackers with knowledge of a victim's email address to potentially brute force the necessary 6-digit verification codes. As a result, attackers can obtain verification tokens that may be exploited for unauthorized access during account signup, login, and recovery procedures. This vulnerability underscores the importance of stringent security measures in multi-factor authentication setups.

References