Philipoffroad

**Name of the Vulnerable Software and Affected Versions** Plane versions prior to 1.4.0 **Description** The magic-code email login uses a six-digit numeric One-Time Password (OTP) with approximately 20 bits of entropy. The system lacks a per-code failed-attempt counter, meaning incorrect codes do not increment a counter, invalidate the Redis entry, or lock the email address. Additionally, the verifier extends `django.views.View` instead of `APIView`, which prevents the `AnonRateThrottle` limit from applying. The middleware stack also lacks Django-level rate limiters such as `django-ratelimit`, `django-axes`, or IP-throttling middleware, allowing for the brute-forcing of magic codes to hijack accounts. **Recommendations** Update to version 1.4.0.