CVE-2026-126571

Padloc versions 4.0.0 before 4.3.1 are vulnerable to an authentication bypass due to a flaw in the legacy retrieveMFAToken handler. The system fails to count incorrect email verification codes toward the attempt limit, allowing unauthenticated attackers who know a victim's email to brute force th...

EUVD-2026-123085

Padloc 4.0.0 before 4.3.1 contains an authentication bypass vulnerability in the legacy retrieveMFAToken handler that never counts wrong email verification codes toward the attempt limit. Unauthenticated attackers knowing a victim's email can brute force the 6-digit code to obtain verification...

CVE-2026-126571: padloc: Padloc 4.0.0 before 4.3.1 contains an authentication bypass vulnerability in the legacy retrieveMFAToken handler that…

Padloc 4.0.0 before 4.3.1 contains an authentication bypass vulnerability in the legacy retrieveMFAToken handler that never counts wrong email verification codes toward the attempt limit. Unauthenticated attackers knowing a victim's email can brute force the 6-digit code to obtain verification...

PT-2026-144954

Padloc 4.0.0 before 4.3.1 contains an authentication bypass vulnerability in the legacy retrieveMFAToken handler that never counts wrong email verification codes toward the attempt limit. Unauthenticated attackers knowing a victim's email can brute force the 6-digit code to obtain verification...