Threats tagged 'ghsa-6wg9-frw9-v5ph'

OpsTree BuildPiper versions prior to 2.7.0 have a vulnerability in the password-reset OTP verification process due to the absence of rate limiting. This allows unauthenticated attackers to brute force 6-digit OTP codes by repeatedly submitting guesses to the check_otp endpoint. Successful exploitation enables attackers to reset the target user's password and take over their account.