Account Login Vulnerability in Paaster Pastebin Application by Ward Pearce
CVE-2026-68512

6.3MEDIUM

Key Information:

Vendor

Wardpearce

Status
Paaster
Vendor
CVE Published:
11 November 2026

What is CVE-2026-68512?

The Paaster pastebin application, prior to version 3.3.0, contains a vulnerability in its account login functionality that lacks essential security measures such as rate limiting, lockout, and CAPTCHA. This oversight allows malicious actors to repeatedly attempt to access user accounts without restriction. Additionally, an associated endpoint reveals whether a username exists, along with the password-hashing salts for that account, making it easier for attackers to enumerate potential accounts and execute brute-force password attacks unhindered. This vulnerability compromise can lead to unauthorized access to user data. The issue has been addressed in version 3.3.0.

Affected Version(s)

paaster < 3.3.0

References

https://github.com/WardPearce/paaster/security/advisories...
x_refsource_CONFIRM
https://github.com/WardPearce/paaster/releases/tag/v3.3.0
x_refsource_MISC

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.