Basic Authentication Vulnerability in Tandoor Recipes by Tandoor

CVE-2026-33152

What is CVE-2026-33152?

Tandoor Recipes, an application for managing meal recipes, had a security vulnerability related to Basic Authentication in versions prior to 2.6.0. The integration with Django REST Framework inadvertently allowed for weak authentication measures. Although rate limiting was implemented for the HTML-based login endpoint, API endpoints remained vulnerable, allowing attackers to bypass these protections. With unlimited login attempts possible against any known username, attackers could exploit this flaw through rapid password guessing attacks, significantly compromising user accounts. Version 2.6.0 addresses this security gap, ensuring a more robust authentication framework.

References