CVE-2026-127079: OpsTree BuildPiper before 2.7.0 OTP Brute Force via password_reset/check_otp
OpsTree BuildPiper before 2.7.0 lacks rate limiting on password-reset OTP verification, allowing unauthenticated attackers to brute force 6-digit OTPs. Attackers can initiate a reset and submit unthrottled guesses to the checkotp endpoint, resetting the target's password and taking over the account.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
OpsTree BuildPiper versions before 2.7.0 are affected. The issue is reachable over the network through the password-reset OTP verification flow.
What does an attacker need to exploit this?
No authentication or user interaction is required. An attacker can initiate a password reset for a target account and repeatedly submit guesses for its six-digit OTP to the check_otp endpoint.
What is the practical impact of successful exploitation?
A successful OTP guess allows the attacker to reset the target account's password and take over that account. The reported impact includes high confidentiality and integrity impact, with no availability impact.
Is there a workaround if upgrading is not immediately possible?
The provided information identifies the absence of rate limiting as the enabling condition. No specific supported workaround or mitigation is provided beyond using a version that is not before 2.7.0.