CVE-2026-127079
Received Received - Intake

Unauthenticated Password Reset Brute Force in BuildPiper

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
OpsTree BuildPiper before 2.7.0 lacks rate limiting on password-reset OTP verification, allowing unauthenticated attackers to brute force 6-digit OTPs. Attackers can initiate a reset and submit unthrottled guesses to the check_otp endpoint, resetting the target's password and taking over the account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-127079
EUVD
EUVD-2026-125103

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
OpsTree Solutions BuildPiper From 0 (inc) to 2.7.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-307 The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-127079 is an OTP brute force vulnerability in OpsTree BuildPiper versions before 2.7.0. The password-reset OTP verification endpoint lacks rate limiting, allowing unauthenticated attackers to submit unlimited guesses for 6-digit OTPs. Attackers can initiate a password reset and brute force the OTP to take over the target account.

Detection Guidance

Monitor the password-reset OTP verification endpoint for unusually high request volumes. Check logs for repeated attempts to the /password_reset/check_otp endpoint with varying OTP values. Use tools like curl to test the endpoint for rate limiting absence by sending multiple requests in quick succession.

Impact Analysis

If you use BuildPiper versions before 2.7.0, attackers could reset your account password by brute forcing the OTP. This leads to complete account takeover, unauthorized access to sensitive data, and potential control over DevSecOps pipelines or CI/CD processes.

Compliance Impact

This vulnerability could violate GDPR (data protection) and HIPAA (health data security) by enabling unauthorized access to personal or sensitive data. Account takeover risks non-compliance with access control and data protection requirements.

Mitigation Strategies

Upgrade BuildPiper to version 2.7.0 or later. Implement rate limiting on the /password_reset/check_otp endpoint. Shorten OTP validity windows and add progressive delays after failed attempts. Introduce CAPTCHA or temporary account lockouts after multiple failed OTP submissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-127079. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...