CVE-2026-68512: Paaster: No rate limiting on account login, combined with a public username-enumeration/salt endpoint, enables offline credential-stuffing
Paaster is a pastebin application. Prior to version 3.3.0, Paaster's account login has no rate limiting, lockout, or CAPTCHA of any kind, and a companion endpoint openly discloses whether a username exists along with that account's password-hashing salts. Together these let an attacker enumerate real accounts and then brute-force their passwords with unlimited, unthrottled attempts. This issue has been patched in version 3.3.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Paasterto a version that resolves this vulnerability.Fixed in 3.3.0
Event History
Frequently Asked Questions
Which deployments are affected?
Paaster versions prior to 3.3.0 are affected. The vulnerable login behavior lacks rate limiting, lockout, and CAPTCHA, while the companion endpoint publicly reveals whether usernames exist and exposes password-hashing salts.
What does an attacker need to exploit this issue?
An attacker can interact with the publicly reachable username-enumeration/salt endpoint and login functionality; no account or user interaction is required. They can enumerate valid accounts and make unlimited password attempts against them.
Is the default login configuration protected by throttling or lockouts?
No. Prior to 3.3.0, the login process has no rate limiting, account lockout, or CAPTCHA.
What should be done if upgrading cannot happen immediately?
The provided information does not identify a supported workaround. Upgrading to Paaster 3.3.0 is the documented fix.
How can administrators determine whether they are affected?
Check the deployed Paaster version. Instances running a version earlier than 3.3.0 are affected.