CVE-2026-129161

Name of the Vulnerable Software and Affected Versions Dromara free-fs versions 2.0.1 through 2.3.1

Description An improper restriction of authentication attempts allows unauthenticated attackers to perform a brute-force attack against six-digit password reset codes. By requesting a code for a known email address, an attacker can submit unlimited guesses within the 300-second validity period of the code to set a chosen password and take over the account. This occurs via the PUT '/apis/user/forget-password' endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.