Plainpad Missing Rate Limiting Leading to Unauthenticated Login Requests

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulnCheck

Description

Plainpad through 1.1.1, fixed in commit d3823fc, contains a missing rate limiting vulnerability that allows unauthenticated attackers to send unbounded login requests to the POST /v1/sessions endpoint due to dead code in App\Http\Kernel.php that is never instantiated under the Laravel 11+ skeleton, leaving the API throttle configuration unattached to any route. Attackers can exploit this by sending unlimited credential attempts with no lockout or CAPTCHA enforcement, and additionally trigger CPU exhaustion by forcing repeated bcrypt comparisons on each request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-08-19

EPSS Evaluated

N/A

NVD

CVE-2026-73529

EUVD

EUVD-2026-61159

Affected Vendors & Products

Vendor	Product	Version / Range
plainpad	plainpad	to 1.1.1 (inc)
alextselegidis	plainpad	to 1.1.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-307	The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

Detection Guidance

Check Plainpad logs for excessive POST /v1/sessions requests from single IPs or repeated failed login attempts. Monitor CPU usage spikes during login attempts. Verify if rate limiting headers (429 responses) are missing for the endpoint.

Mitigation Strategies

Apply the patch from commit d3823fc. Configure rate limiting for POST /v1/sessions with strict limits per email/IP. Monitor API endpoints for unusual traffic patterns. Consider temporary firewall rules to block excessive login attempts.

Hi! I’m here to help you understand CVE-2026-73529. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70