CVE-2026-119705

SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because verifyUser is never called. Attackers can repeatedly POST to /api/notify, optionally with a domain parameter, to exhaust...

CVE-2026-119705 SerpBear before 3.1.1 Missing Authentication via POST /api/notify

SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because verifyUser is never called. Attackers can repeatedly POST to /api/notify, optionally with a domain parameter, to exhaust...

CVE-2026-119705 SerpBear before 3.1.1 Missing Authentication via POST /api/notify

SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because verifyUser is never called. Attackers can repeatedly POST to /api/notify, optionally with a domain parameter, to exhaust...

CVE-2026-119705

SerpBear versions before 3.1.1 are vulnerable to a missing authentication flaw in the pages/api/notify.ts component. The root cause is that the verifyUser() function is never invoked, allowing remote unauthenticated attackers to send repeated POST requests to /api/notify. This can be used to floo...

PT-2026-133639

SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because verifyUser is never called. Attackers can repeatedly POST to /api/notify, optionally with a domain parameter, to exhaust...