CVE-2026-105638
CRITICAL 9.1Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and an incorrect code does not increment a counter, invalidate the Redis entry, or lock the email address. The verifier extends django.views.View rather than DRF's APIView, so the configured AnonRateThrottle limit does not apply. The middleware stack also contains no Django-level rate limiter such as django-ratelimit, django-axes, or an IP-throttling middleware. This vulnerability is fixed in 1.4.0.
Severe if exploited (CVSS 9.1), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.4%chance of exploitation in 30 days · 32nd percentile
Impact if exploited
9.1CVSS 3.1 · CRITICAL
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-307: : Improper Restriction of Excessive Authentication Attempts
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References and research data (JSON)
All CVSS metrics
- CRITICAL 9.1 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - CRITICAL 9.1 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
Exploit-tagged references (not proof of a PoC)
- https://github.com/makeplane/plane/security/advisories/GHSA-mqjv-rwgv-4gxq CVE record · GitHub_M · Updated 2026-10-05T18:09:35.649Z
CVE record · CISA-ADP · Updated 2026-10-05T18:44:08.562Z
NVD · CVE-2026-105638 · Updated 2026-10-05T19:17:18.173
Advisories
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-92594 EUVD · EUVD-2026-92594
Technical & other
- https://github.com/makeplane/plane/pull/9130 CVE record · GitHub_M · Updated 2026-10-05T18:09:35.649Z
NVD · CVE-2026-105638 · Updated 2026-10-05T19:17:18.173 - https://github.com/makeplane/plane/commit/b1c78fe4c832e188454840eb38fd20cd05ef8b0a CVE record · GitHub_M · Updated 2026-10-05T18:09:35.649Z
NVD · CVE-2026-105638 · Updated 2026-10-05T19:17:18.173 - https://github.com/makeplane/plane/releases/tag/v1.4.0 CVE record · GitHub_M · Updated 2026-10-05T18:09:35.649Z
NVD · CVE-2026-105638 · Updated 2026-10-05T19:17:18.173