CVE-2026-73529 describes a missing rate limiting vulnerability in Plainpad through version 1.1.1. The vulnerability arises because the API throttle configuration is never attached to any route due to dead code in App\Http\Kernel.php, which is not instantiated under the Laravel 11+ skeleton. As a result, unauthenticated attackers can send unlimited login attempts to the POST /v1/sessions endpoint without any lockout or CAPTCHA enforcement. This allows brute force attacks on credentials and can cause CPU exhaustion by forcing repeated bcrypt password hash comparisons. The issue is resolved in commit d3823fc.

Attackers can perform unlimited authentication attempts against the Plainpad login API without restriction, enabling brute force attacks to guess credentials. Additionally, the repeated bcrypt computations on each request can lead to CPU exhaustion, potentially degrading service availability. There is no indication of privilege escalation or data exposure beyond the authentication bypass attempts.

A fix is available in the commit identified as d3823fc which addresses the missing rate limiting by properly attaching API throttle configuration to the login route. Users should upgrade to a version including this fix. Patch status is not explicitly confirmed beyond the commit reference; check the vendor repository for the fixed version. Until patched, implement external rate limiting or WAF rules to limit login attempts as a temporary mitigation.