CVE-2026-127079

OpsTree BuildPiper before 2.7.0 lacks rate limiting on password-reset OTP verification, allowing unauthenticated attackers to brute force 6-digit OTPs. Attackers can initiate a reset and submit unthrottled guesses to the checkotp endpoint, resetting the target's password and taking over the accou...

EUVD-2026-125103

OpsTree BuildPiper before 2.7.0 lacks rate limiting on password-reset OTP verification, allowing unauthenticated attackers to brute force 6-digit OTPs. Attackers can initiate a reset and submit unthrottled guesses to the checkotp endpoint, resetting the target's password and taking over the accou...

CVE-2026-127079

OpsTree BuildPiper versions prior to 2.7.0 are vulnerable to a brute force attack due to a lack of rate limiting on the password_reset/check_otp endpoint. Unauthenticated attackers can initiate a password reset and submit unthrottled guesses for the 6-digit OTP, potentially leading to unauthorize...