PT-2026-144954
CVE-2026-126571
·
Published
2026-11-11
·
Updated
2026-11-11
Description by
CVSS 3.1
4.8
MediumMetricsAV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Padloc 4.0.0 before 4.3.1 contains an authentication bypass vulnerability in the legacy retrieveMFAToken handler that never counts wrong email verification codes toward the attempt limit. Unauthenticated attackers knowing a victim's email can brute force the 6-digit code to obtain verification tokens usable in signup, login and account recovery flows.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾