Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Plane email login allows unlimited OTP guessing

CVE-2026-105638 · published 6 days ago
Summary

The Plane project‑management tool lets anyone try unlimited six‑digit email login codes because it does not limit how often a code can be entered. This means an attacker could repeatedly guess the code until it succeeds. Upgrade Plane to version 1.4.0 or later, which adds proper rate‑limiting and lockout controls.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
makeplane plane < 1.4.0
Original advisory text
Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force
Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and an incorrect code does not increment a counter, invalidate the Redis entry, or lock the email address. The verifier extends django.views.View rather than DRF's APIView, so the configured AnonRateThrottle limit does not apply. The middleware stack also contains no Django-level rate limiter such as django-ratelimit, django-axes, or an IP-throttling middleware. This vulnerability is fixed in 1.4.0.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-307Improper Restriction of Excessive Authentication Attempts
Timeline
Published5 Oct 2026
Updated11 Oct 2026
First seen5 Oct 2026
Sources
CVE-2026-105638 · NVD
CVE-2026-105638 · MITRE
CVE-2026-105638 · OSV
GHSA-mqjv-rwgv-4gxq · GHSA
Track software like this
Free during beta