CVE-2026-105638: Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force
Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and an incorrect code does not increment a counter, invalidate the Redis entry, or lock the email address. The verifier extends django.views.View rather than DRF's APIView, so the configured AnonRateThrottle limit does not apply. The middleware stack also contains no Django-level rate limiter such as django-ratelimit, django-axes, or an IP-throttling middleware. This vulnerability is fixed in 1.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Planeto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
Which deployments are affected?
Plane versions prior to 1.4.0 are affected where magic-code email login is available. Version 1.4.0 contains the fix.
What does an attacker need to exploit this?
An attacker can remotely submit repeated guesses against the magic-code verifier without authentication or user interaction. The target is a six-digit numeric email OTP, and failed guesses do not lock the email address or invalidate the stored code.
Why does the configured anonymous API throttle not protect this endpoint?
The verifier extends django.views.View instead of DRF's APIView, so Plane's configured AnonRateThrottle does not apply to it. The described middleware stack also has no Django-level or IP-based rate-limiting middleware.
How can I determine whether mitigation is needed?
Check whether the Plane deployment is running a version earlier than 1.4.0 and uses the magic-code email login flow. Also verify whether the verifier endpoint has an effective rate limit outside of DRF, since the configured AnonRateThrottle does not cover this view.