CVE-2026-119705 SerpBear before 3.1.1 Missing Authentication via POST /api/notify

SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because verifyUser is never called. Attackers can repeatedly POST to /api/notify, optionally with a domain parameter, to exhaust...