CVE-2026-73529

Name of the Vulnerable Software and Affected Versions Plainpad versions prior to 1.1.1

Description An issue exists where unauthenticated attackers can send unbounded login requests to the 'POST /v1/sessions' endpoint. This occurs because dead code in AppHttpKernel.php is not instantiated under the Laravel 11+ skeleton, which leaves the API throttle configuration unattached to any route. This allows for unlimited credential attempts without lockout or CAPTCHA enforcement and can lead to CPU exhaustion by forcing repeated bcrypt comparisons on each request.

Recommendations Update Plainpad to the version containing commit d3823fc.