CVE-2026-126571

MediumCVSS 4.8/10Last modified Nov 12, 2026

Description

Padloc 4.0.0 before 4.3.1 contains an authentication bypass vulnerability in the legacy retrieveMFAToken handler that never counts wrong email verification codes toward the attempt limit. Unauthenticated attackers knowing a victim's email can brute force the 6-digit code to obtain verification tokens usable in signup, login and account recovery flows.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-307

Affected software

VendorProductVersions
padlocpadloc>= 4.0.0, < 4.3.1

References

Timeline

Published
Nov 11, 2026
Last modified
Nov 12, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-126598.7A denial-of-service security issue exists in the affected products. The security issue stems from improper handling of exceptional conditionCVE-2026-12664.4The Postalicious plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, CVE-2026-126602.7IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation.CVE-2026-1266077.8Progressive Robot hMailServer 6.2.3 through 6.3.7 on Windows, with a MySQL or MariaDB database, hands the bundled MariaDB Connector/C the foCVE-2026-1266097.5Progressive Robot hMailServer 6.2.25 through 6.3.7 on Windows, with a PostgreSQL database, the connection's sslmode require, verify-ca or veCVE-2026-126614.8A denial-of-service security issue exists within FactoryTalk® Historian Machine Edition.  A network adjacent attacker who is authenticated cCVE-2026-1266107.4Progressive Robot hMailServer 6.3.4 through 6.3.7, with a MySQL or MariaDB database and TlsMode=verify-full, does not hand the database clieCVE-2026-1266117.0Progressive Robot hMailServer 6.3.4 through 6.3.7, with a MySQL or MariaDB database, TlsMode=verify-full and no TlsCaFile, does not verify tCVE-2026-1266127.8Improper link resolution in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.7 allows a local authenticated user to CVE-2026-1266137.5Allocation of resources without limits in the JSON reader of Progressive Robot hMailServer 6.3.2 through 6.3.7 allows a remote attacker to eCVE-2026-1266145.3The web services listener of Progressive Robot hMailServer 6.3.3 through 6.3.7 does not apply the server's IP ranges to the connections it aCVE-2026-1266155.3The sign-in of Progressive Robot hMailServer 6.2.22-pre2 through 6.3.7 takes for an account names that are not its address but under which t
CVE-2026-126571: Medium severity, CVSS 4.8 | Vulnix