CVE-2026-126571: Padloc 4.0.0 before 4.3.1 Email MFA Code Brute Force via retrieveMFAToken
Padloc 4.0.0 before 4.3.1 contains an authentication bypass vulnerability in the legacy retrieveMFAToken handler that never counts wrong email verification codes toward the attempt limit. Unauthenticated attackers knowing a victim's email can brute force the 6-digit code to obtain verification tokens usable in signup, login and account recovery flows.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Padloc versions 4.0.0 through versions before 4.3.1 are affected. The issue is in the legacy retrieveMFAToken handler used for email verification in signup, login, and account recovery flows.
What does an attacker need to exploit this issue?
An attacker does not need to authenticate or interact with the victim. They need to know the victim's email address and repeatedly guess the six-digit email verification code.
Why can the verification code be brute-forced?
Wrong email verification codes submitted through the legacy handler are not counted toward the attempt limit. This permits repeated guesses until a valid code is found, despite the intended limiting mechanism.
What could an attacker do after obtaining a valid verification token?
The token can be used in signup, login, and account recovery flows. The provided information does not specify the exact account actions or data access available in each flow.