Threats tagged 'ghsa-2j5h-qj2m-vqhp'

SerpBear versions prior to 3.1.1 have a missing authentication vulnerability in the pages/api/notify.ts endpoint. This flaw allows remote unauthenticated attackers to send repeated POST requests to /api/notify without verification, potentially exhausting SMTP rate limits, triggering abuse flags from email providers, and flooding notification recipients with emails.