PT-2026-68051

Name of the Vulnerable Software and Affected Versions Typemill affected versions not specified Description The login endpoint 'POST /tm/login' using the login function in ControllerWebAuth lacks rate-limiting, failed-attempt counting, and account lockout mechanisms when the captcha is disabled,...

CVE-2026-71213: Improper Restriction of Excessive Authentication Attempts

Typemill's login endpoint POST /tm/login, ControllerWebAuth::login performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account,...