CVE-2026-71213

Summary

The flaw allows an attacker to perform unlimited password-guessing attempts against any account, including administrators, due to the absence of rate-limiting or account lockout mechanisms when the captcha is disabled, which is the default configuration.

Exploitability

Exploitation is relatively easy as the default configuration disables the captcha, allowing an attacker to send unlimited requests without any throttling or account lockout.

Blast radius

If exploited, this flaw could lead to unauthorized access to sensitive accounts, potentially compromising the entire system, including administrative accounts.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Enable the captcha feature, or implement rate-limiting and account lockout mechanisms for the login endpoint.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.