Threats affecting pkg:github/padloc/padloc

Padloc versions from 4.0.0 up to but not including 4.3.1 contain an authentication bypass vulnerability in the legacy retrieveMFAToken handler. This flaw allows unauthenticated attackers who know a victim's email address to brute force the 6-digit multi-factor authentication code without incrementing the attempt limit. Successful brute forcing can yield verification tokens that are usable in signup, login, and account recovery processes.

Padloc versions 4.0.0 up to but not including 4.3.1 contain a prototype pollution vulnerability. This flaw allows SCIM token holders to modify the Object.prototype by sending specially crafted SCIM PATCH requests to the ScimServer._handleScimUsersPatch() function. By manipulating paths such as __proto__.x or constructor.prototype.x, attackers can pollute the shared server process, potentially disrupting requests for all organizations served by that process. The vulnerability has a high severity rating with a CVSS score of 7.6.