---
id: "CVE-2026-126571"
page: "https://infrastack.ai/live/CVE-2026-126571"
kind: "vulnerability"
aliases: ["CVE-2026-126571"]
title: "Padloc: MFA code brute force lets attackers take over accounts"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "padloc", "password-manager", "self-hosted"]
not_affected_if: ["version-4.3.1-or-later"]
published_at: "2026-11-11T03:16:51+00:00"
first_seen_at: "2026-11-11T03:25:00+00:00"
updated_at: "2026-11-11T03:26:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126571", "first_seen_at": "2026-11-11T03:25:00+00:00"}]
exploit_sources: []
---

# Padloc: MFA code brute force lets attackers take over accounts

Link for people: https://infrastack.ai/live/CVE-2026-126571 (this .md is for agents)

Padloc 4.0.0 before 4.3.1 has a legacy retrieveMFAToken handler that does not count wrong email verification codes toward the attempt limit. An unauthenticated attacker who knows a victim's email can brute-force the 6-digit code and obtain tokens usable for signup, login and account recovery.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Padloc server version; affected range is `4.0.0` up to but not including `4.3.1`

## Fix

- Padloc: upgrade to `4.3.1` or later (per the sources' affected range)

## Timeline

- 2026-11-11T03:25:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126571

## Documents

- [advisory] Vendor advisory: github.com https://github.com/padloc/padloc/security/advisories/GHSA-3mq5-m2qg-fqhq
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/padloc-4.0.0-before-4.3.1-email-mfa-code-brute-force-via-retrievemfatoken
- [fix] Patch: github.com https://github.com/padloc/padloc/commit/26f292515fe623826070454872f9cee08b756544

## From the sources

Padloc 4.0.0 before 4.3.1 contains an authentication bypass vulnerability in the legacy retrieveMFAToken handler that never counts wrong email verification codes toward the attempt limit. Unauthenticated attackers knowing a victim's email can brute force the 6-digit code to obtain verification tokens usable in signup, login and account recovery flows.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_