Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-105638— Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force

Quick assessment

Affected

makeplane plane

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Plane 是一款开源的项目管理工具。在 1.4.0 版本之前，Plane 的“magic-code”（魔术码）邮件登录方式使用的是六位数数字的一次性密码（OTP），其熵值约为 20 比特。该验证机制缺乏针对每个密码的失败尝试次数计数器，即使输入的代码错误，也不会增加失败计数、使 Redis 中的条目失效，也不会锁定对应的电子邮件地址。此外，该验证器的实现基于 Django 的而非 DRF（Django REST Framework）的，因此配置的（匿名访问速率限制）策略不生效。同时，中间件栈中也没有部署任何

CVSS 9.1 · Critical Updated Oct 06, 2026

Possible ATT&CK Techniques 1 AI

T1110.004 · Credential Stuffing

Affected Version Matrix 1

Vendor	Product	Version Range	Status
makeplane	plane	`< 1.4.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force

Source: CVE Program / CVE List V5

Vulnerability Description

Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and an incorrect code does not increment a counter, invalidate the Redis entry, or lock the email address. The verifier extends django.views.View rather than DRF's APIView, so the configured AnonRateThrottle limit does not apply. The middleware stack also contains no Django-level rate limiter such as django-ratelimit, django-axes, or an IP-throttling middleware. This vulnerability is fixed in 1.4.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

过多认证尝试的限制不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
makeplane	plane	< 1.4.0	-

II. Public POCs for CVE-2026-105638

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-105638

请登录查看更多情报信息。

Other References for CVE-2026-105638 (4)

https://github.com/makeplane/plane/pull/9130 x_refsource_MISC
https://github.com/makeplane/plane/releases/tag/v1.4.0 x_refsource_MISC
https://github.com/makeplane/plane/security/advisories/GHSA-mqjv-rwgv-4gxq x_refsource_CONFIRM
https://github.com/makeplane/plane/commit/b1c78fe4c832e188454840eb38fd20cd05ef8b0a x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-105638

Same Patch Batch · makeplane · 2026-10-05 · 38 CVEs total

CVE-2026-105636	9.9 CRITICAL	Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)
CVE-2026-105639	9.8 CRITICAL	Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation tok
CVE-2026-105641	9.8 CRITICAL	Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deploy
CVE-2026-105637	9.6 CRITICAL	Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-4
CVE-2026-105640	9.1 CRITICAL	Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)
CVE-2026-105632	8.7 HIGH	Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private
CVE-2026-104892	8.7 HIGH	Plane: Plaintext logging of API token
CVE-2026-104966	8.7 HIGH	Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inj
CVE-2026-104976	8.7 HIGH	Plane: SSRF in Gitea OAuth
CVE-2026-104979	8.7 HIGH	Plane: Cross-tenant stored XSS in intake enables account takeover
CVE-2026-105630	8.7 HIGH	Plane: Stored XSS via SVG attachment served inline on the application origin (account take
CVE-2026-104968	8.7 HIGH	Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/
CVE-2026-104971	8.5 HIGH	Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEn
CVE-2026-104978	8.2 HIGH	Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acc
CVE-2026-104970	8.1 HIGH	Plane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated calle
CVE-2026-105634	8.1 HIGH	Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles
CVE-2026-104974	8.1 HIGH	Plane: Disabled User Auto-Reactivation on Login
CVE-2026-104977	7.7 HIGH	Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (
CVE-2026-104973	7.6 HIGH	Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery
CVE-2026-105628	7.6 HIGH	Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset End

Showing top 20 of 38 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: plane

Same vendor: makeplane

Same weakness: CWE-307

V. Comments for CVE-2026-105638

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-105638— Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 1

I. Basic Information for CVE-2026-105638

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-105638

III. Intelligence Information for CVE-2026-105638

Other References for CVE-2026-105638 (4)

Same Patch Batch · makeplane · 2026-10-05 · 38 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-105638

Leave a comment