Threats tagged 'ghsa-qm2w-w3vc-pjgw'

Padloc versions from 4.0.0 up to but not including 4.3.1 contain an authentication bypass vulnerability in the legacy retrieveMFAToken handler. This flaw allows unauthenticated attackers who know a victim's email address to brute force the 6-digit multi-factor authentication code without incrementing the attempt limit. Successful brute forcing can yield verification tokens that are usable in signup, login, and account recovery processes.