PT-2026-137402

CVE-2026-19256

Published

2026-11-05

Updated

2026-11-06

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions All In One Login versions prior to 2.5.0

Description The passwordless email login feature, which is enabled by default, fails to adequately restrict the number of attempts for the short numeric code. Additionally, these failed attempts are not recorded by the internal brute-force protection system. This allows unauthenticated attackers to perform a brute-force attack on the One-Time Password (OTP) to take over any account, including those with administrator privileges.

Recommendations Update All In One Login to version 2.5.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Jakub Herman

Vendors

Affected products

Weakness enumeration

CWE-269: Improper Privilege Management

Related identifiers