CVE-2026-73529
Last modified
CVE-2026-73529 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Plainpad through 1.1.1, fixed in commit d3823fc, contains a missing rate limiting vulnerability that allows unauthenticated attackers to send unbounded login requests to the POST /v1/sessions endpoint due to dead code in App\Http\Kernel.php that is never instantiated under the Laravel 11+ skeleton, leaving the API throttle configuration unattached to any route. Attackers can exploit this by sending unlimited credential attempts with no lockout or CAPTCHA enforcement, and additionally trigger CPU exhaustion by forcing repeated bcrypt comparisons on each request..
Description
Plainpad through 1.1.1, fixed in commit d3823fc, contains a missing rate limiting vulnerability that allows unauthenticated attackers to send unbounded login requests to the POST /v1/sessions endpoint due to dead code in App\Http\Kernel.php that is never instantiated under the Laravel 11+ skeleton, leaving the API throttle configuration unattached to any route. Attackers can exploit this by sending unlimited credential attempts with no lockout or CAPTCHA enforcement, and additionally trigger CPU exhaustion by forcing repeated bcrypt comparisons on each request.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| alextselegidis | plainpad | <= 1.1.1 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-73529?
How severe is CVE-2026-73529?
How do I fix CVE-2026-73529?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-73514The address_standardizer extension for PostGIS through 3.7.0…8.8
- CVE-2026-73515PostGIS before 3.7.0beta2 contains an out-of-bounds read vul…8.1
- CVE-2026-73519WolfStack before 25.9.2 contains a hard-coded cluster-authen…9.8
- CVE-2026-7352Use after free in Media in Google Chrome on Android prior to…8.3
- CVE-2026-73522COVESA Open1722 through 0.9.2 contains a stack buffer overfl…7.5
- CVE-2026-73523COVESA Open1722 through 0.9.2 contains an integer truncation…7.5
- CVE-2026-7353Heap buffer overflow in Skia in Google Chrome prior to 147.0…8.3
- CVE-2026-73530Flyto2 Core before 2.28.0 contains a server-side request for…7.7
- CVE-2026-73531django-helpdesk before 2.3.3 contains a stored cross-site sc…6.1
- CVE-2026-73532Fluent Forms Pro 6.2.7 contains an embedded malicious code v…9.8
- CVE-2026-73533Ninja Tables Pro 5.2.11 contains an embedded malicious code …9.8
- CVE-2026-73537Cross-site scripting vulnerability exists in Miraikan Assist…5.1
Are you affected by CVE-2026-73529?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST