{"id":"CVE-2026-126571","kind":"vulnerability","aliases":["CVE-2026-126571"],"related":[],"title":"Padloc: MFA code brute force lets attackers take over accounts","description":"Padloc 4.0.0 before 4.3.1 contains an authentication bypass vulnerability in the legacy retrieveMFAToken handler that never counts wrong email verification codes toward the attempt limit. Unauthenticated attackers knowing a victim's email can brute force the 6-digit code to obtain verification tokens usable in signup, login and account recovery flows.","summary":"Padloc 4.0.0 before 4.3.1 has a legacy retrieveMFAToken handler that does not count wrong email verification codes toward the attempt limit. An unauthenticated attacker who knows a victim's email can brute-force the 6-digit code and obtain tokens usable for signup, login and account recovery.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","padloc","password-manager","self-hosted"],"not_affected_if":["version-4.3.1-or-later"],"how_to_check":"- Check the installed Padloc server version; affected range is `4.0.0` up to but not including `4.3.1`","fix":"- Padloc: upgrade to `4.3.1` or later (per the sources' affected range)","status":"open","published_at":"2026-11-11T03:16:51+00:00","first_seen_at":"2026-11-11T03:25:00+00:00","triaged_at":"2026-11-11T03:26:25+00:00","updated_at":"2026-11-11T03:26:25+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T03:26:25Z","model":"claude-haiku-5-5","output":{"fix":"- Padloc: upgrade to `4.3.1` or later (per the sources' affected range)","reach":"internet","title":"Padloc: MFA code brute force lets attackers take over accounts","impact":"high","summary":"Padloc 4.0.0 before 4.3.1 has a legacy retrieveMFAToken handler that does not count wrong email verification codes toward the attempt limit. An unauthenticated attacker who knows a victim's email can brute-force the 6-digit code and obtain tokens usable for signup, login and account recovery.","audience":"businesses","category":"package","nicknames":[],"who_cares":["padloc","self-hosted","password-manager"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker obtains verification tokens and takes over accounts","analyst_note":"Confirm the exact affected range and whether the legacy handler is reachable in default configs; check the vendor advisory on github.com linked in the sources.","how_to_check":"- Check the installed Padloc server version; affected range is `4.0.0` up to but not including `4.3.1`\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-4.3.1-or-later"],"who_is_affected":"Self-hosted Padloc deployments in the 4.0.0 to 4.3.1 range that expose the legacy retrieveMFAToken endpoint are exposed. Hosted or already-upgraded instances are not. Sources do not state more detail on configuration.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000744,"input_tokens":4641,"output_tokens":559,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126571':13A,16A '-2026':12A,15A '4.0.0':26B,74C '4.3.1':28B,76C '6':60B,109C 'account':10A,71B,121C 'attack':7A,48B,99C 'attempt':44B,96C 'authent':79C 'brute':4A,57B,106C 'brute-forc':56B 'bypass':80C 'code':3A,41B,62B,93C,111C 'contain':77C 'count':37B,89C 'cve':11A,14A 'digit':61B,110C 'email':39B,54B,91C,104C 'flow':123C 'forc':5A,58B,107C 'handler':33B,86C 'host':24B 'know':50B,100C 'legaci':31B,84C 'let':6A 'limit':45B,97C 'login':69B,119C 'manag':21B 'mfa':2A 'never':88C 'obtain':64B,113C 'packag':17B 'padloc':1A,18B,25B,73C 'password':20B 'password-manag':19B 'recoveri':72B,122C 'retrievemfatoken':32B,85C 'self':23B 'self-host':22B 'signup':68B,118C 'take':8A 'token':65B,115C 'toward':42B,94C 'unauthent':47B,98C 'usabl':66B,116C 'verif':40B,92C,114C 'victim':52B,102C 'vulner':81C 'wrong':38B,90C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Padloc deployments in the 4.0.0 to 4.3.1 range that expose the legacy retrieveMFAToken endpoint are exposed. Hosted or already-upgraded instances are not. Sources do not state more detail on configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","padloc","passwordmanager","selfhosted"],"campaign_type":null,"search_a":"'-126571':13A,16A '-2026':12A,15A 'account':10A 'attack':7A 'brute':4A 'code':3A 'cve':11A,14A 'forc':5A 'let':6A 'mfa':2A 'padloc':1A 'take':8A","search_b":"'4.0.0':26B '4.3.1':28B '6':60B 'account':71B 'attack':48B 'attempt':44B 'brute':57B 'brute-forc':56B 'code':41B,62B 'count':37B 'digit':61B 'email':39B,54B 'forc':58B 'handler':33B 'host':24B 'know':50B 'legaci':31B 'limit':45B 'login':69B 'manag':21B 'obtain':64B 'packag':17B 'padloc':18B,25B 'password':20B 'password-manag':19B 'recoveri':72B 'retrievemfatoken':32B 'self':23B 'self-host':22B 'signup':68B 'token':65B 'toward':42B 'unauthent':47B 'usabl':66B 'verif':40B 'victim':52B 'wrong':38B","search_c":"'4.0.0':74C '4.3.1':76C '6':109C 'account':121C 'attack':99C 'attempt':96C 'authent':79C 'brute':106C 'bypass':80C 'code':93C,111C 'contain':77C 'count':89C 'digit':110C 'email':91C,104C 'flow':123C 'forc':107C 'handler':86C 'know':100C 'legaci':84C 'limit':97C 'login':119C 'never':88C 'obtain':113C 'padloc':73C 'recoveri':122C 'retrievemfatoken':85C 'signup':118C 'token':115C 'toward':94C 'unauthent':98C 'usabl':116C 'verif':92C,114C 'victim':102C 'vulner':81C 'wrong':90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T10:36:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126571","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126571","severity":null,"published_at":"2026-11-11T03:16:51+00:00","modified_at":"2026-11-11T03:16:51+00:00","first_seen_at":"2026-11-11T03:25:00+00:00","fetched_at":"2026-11-11T03:25:00+00:00","note":null}],"documents":[{"id":122061,"url":"https://github.com/padloc/padloc/commit/26f292515fe623826070454872f9cee08b756544","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":122062,"url":"https://github.com/padloc/padloc/security/advisories/GHSA-3mq5-m2qg-fqhq","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-10T10:36:46+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":122063,"url":"https://www.vulncheck.com/advisories/padloc-4.0.0-before-4.3.1-email-mfa-code-brute-force-via-retrievemfatoken","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}