PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force… (CVE-2026-105835)

PLANKA versions 2.2.0 and 2.2.1 do not enforce rate limiting or other restrictions on incorrect TOTP code submissions to the POST /api/access-tokens/verify-totp endpoint. An attacker with knowledge of a user's password can reuse the ten-minute pending token to repeatedly guess six-digit TOTP codes until successful, bypassing two-factor authentication and gaining full access tokens. This vulnerability is identified as CVE-2026-105835 and is associated with CWE-307 (Improper Restriction of Excessive Authentication Attempts).

Successful exploitation allows attackers who know a user's password to bypass two-factor authentication by brute forcing the TOTP code, resulting in unauthorized access with full access tokens. This compromises confidentiality and integrity of user accounts but does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint, monitor for suspicious authentication attempts, and consider additional protective controls such as IP rate limiting or multi-factor authentication methods that are not vulnerable to brute force attacks.