CVE-2026-105638

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0

Description The magic-code email login uses a six-digit numeric One-Time Password (OTP) with approximately 20 bits of entropy. The system lacks a per-code failed-attempt counter, meaning incorrect codes do not increment a counter, invalidate the Redis entry, or lock the email address. Additionally, the verifier extends django.views.View instead of APIView, which prevents the AnonRateThrottle limit from applying. The middleware stack also lacks Django-level rate limiters such as django-ratelimit, django-axes, or IP-throttling middleware, allowing for the brute-forcing of magic codes to hijack accounts.

Recommendations Update to version 1.4.0.