Missing Rate Limiting in Plainpad Affects Unauthenticated Login Attempts
CVE-2026-73529

6.9MEDIUM

Key Information:

Vendor

Alextselegidis

Status
Plainpad
Vendor
CVE Published:
18 August 2026

What is CVE-2026-73529?

Plainpad versions up to 1.1.1 are vulnerable due to a missing rate limiting mechanism, allowing unauthenticated attackers to leverage the POST /v1/sessions endpoint. This vulnerability results from dead code in the application’s kernel, preventing the API throttle configuration from being applied to any route. As a result, attackers can send unlimited login attempts without any lockout or CAPTCHA restrictions, potentially leading to credential stuffing attacks and causing significant strain on the system through repeated bcrypt comparisons.

Affected Version(s)

plainpad 0 <= 1.1.1

plainpad 0 <= 1.1.1

plainpad d3823fc595b5d8f842a6fd7dfe49b7852a10fdac

References

https://github.com/alextselegidis/plainpad/commit/d3823fc...
patch
https://www.vulncheck.com/advisories/plainpad-missing-rat...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eldor Nabijonov
VulnCheck
.