LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS… (CVE-2026-105127)
Description
LaraDashboard versions before 1.4.8 perform advanced email validation on unauthenticated forgot-password and reset-password requests. This validation triggers DNS lookups and paid AbstractAPI verification calls. An unauthenticated attacker can abuse this by submitting arbitrary email addresses, exhausting the verification quota. Once exhausted, validation fails open for all public forms, potentially allowing invalid emails to pass unchecked. This behavior also allows attackers to probe domain resolution via DNS lookups.
CVSS v3.1
Score 5.3medium
Affected software
pkg:github/laradashboard/laradashboardRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
LaraDashboard versions prior to 1.4.8 implement advanced email validation on unauthenticated password reset and forgot-password requests that involve DNS lookups and paid AbstractAPI calls. Attackers can submit arbitrary email addresses to exhaust the quota for these verification calls, causing the validation mechanism to fail open and accept all inputs without proper verification. This can lead to denial of service on the validation mechanism and domain probing via DNS lookups.
Potential Impact
The vulnerability allows unauthenticated attackers to exhaust the email verification quota, causing the validation to fail open and accept all email inputs without proper verification. This may degrade the security of password reset and forgot-password forms by allowing invalid or malicious email addresses to be accepted. Additionally, attackers can use this to probe domain resolution through DNS lookups. There is no direct confidentiality or integrity impact, but availability of the validation service is affected.
Mitigation Recommendations
No official patch or fix is explicitly stated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing rate limiting on password reset and forgot-password endpoints to prevent quota exhaustion, or disable advanced email validation for unauthenticated requests if feasible.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-g2mx-6phx-6vgr
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-105127"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6ac245e212601ec6a31684e9
Added to database: 10/04/2026, 12:26:10 UTC
Last enriched: 10/04/2026, 13:24:27 UTC
Last updated: 10/04/2026, 16:08:35 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.