CVE-2026-71213

9.1 CRITICALpublic exploit available

Published 2026-08-05 · Updated 2026-08-10

AI risk analysis

Summary: The flaw allows unauthenticated attackers to perform unlimited password-guessing attacks due to lack of rate-limiting or account lockout mechanisms when captcha is disabled by default.
Exploitability: Exploitation is relatively easy as no preconditions are required other than disabling the captcha, which is the default setting.
Blast radius: If exploited, this could lead to unauthorized access and potential compromise of administrator accounts with full system control.
Prioritized remediation: Implement rate-limiting and account lockout mechanisms for the login endpoint regardless of captcha usage.

auth-bypassrate-limitingloginsecurity

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account, including administrators, with no throttling.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-307

Public exploit & PoC references

https://github.com/typemill/typemill

All references

https://github.com/typemill/typemill

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.