CVE-2026-111679
Received Received - Intake

Ekko Studio Missing Authorization Lets Authenticated Users Bypass Login Lockouts

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super_admin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll(), disabling the login rate limiter during password guessing against super_admin accounts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111679
EUVD
EUVD-2026-102970

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
EKKOLearnAI ekko-studio 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Ekko Studio through 0.7.36 has a missing authorization vulnerability in the /api/auth/locked-ips endpoint. Any authenticated non-super_admin user can list and clear server-wide login lockouts by sending DELETE requests without an IP parameter. This invokes unlockAll(), disabling the login rate limiter and enabling brute-force attacks against super_admin accounts.

Detection Guidance

Check for unauthorized access to the /api/auth/locked-ips endpoint by monitoring HTTP DELETE requests without an IP parameter. Use tools like curl to test if any authenticated user can list or clear lockouts: curl -X DELETE http://<target>/api/auth/locked-ips. Review server logs for unusual activity on this endpoint.

Impact Analysis

Attackers can bypass rate-limiting protections to perform password guessing attacks against super_admin accounts. This could lead to unauthorized access to sensitive data or system control. The vulnerability also allows listing locked IPs, potentially revealing targeted accounts.

Mitigation Strategies

Apply the latest patch from pull request #3404 which adds super_admin middleware to /api/auth/locked-ips. Restrict DELETE requests to require an IP parameter. Temporarily disable the endpoint if immediate patching is not possible. Monitor for brute-force attempts against super_admin accounts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111679. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart