CVE-2026-71213: typemill: No Rate Limiting on Login Endpoint Enables Unlimited Password Brute-Force
Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login()) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account, including administrators, with no throttling. The only attempt-counting/lockout logic present in the same file protects an optional secondary email-authcode step and does not apply to the primary password check.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71213?
The severity of CVE-2026-71213 is high, rated at 8.1.
How do I fix CVE-2026-71213?
To fix CVE-2026-71213, implement rate limiting and account lockout mechanisms on the login endpoint.
What impact does CVE-2026-71213 have on Typemill?
CVE-2026-71213 allows unlimited password brute-force attempts on the login endpoint, leading to potential unauthorized access.
Which endpoint is affected by CVE-2026-71213?
CVE-2026-71213 affects the POST /tm/login endpoint of Typemill.
Can an attacker exploit CVE-2026-71213 without authentication?
Yes, an unauthenticated attacker can exploit CVE-2026-71213 to perform unlimited password-guessing attempts.