Authentication Flaw in Typemill's Login Endpoint Exposes User Accounts

CVE-2026-71213

What is CVE-2026-71213?

Typemill's login process is vulnerable due to the absence of rate-limiting and account lockout mechanisms when the captcha feature is disabled, which is the default setup. This vulnerability allows unauthenticated attackers to execute repeated password guessing attacks against user accounts, including administrative accounts, without any restrictions. The existing logic for tracking failed attempts is ineffective for the primary password check and is only applied in an optional secondary email-authentication step, leaving critical accounts exposed to significant risk.

References