Vulnerability in Makeplane Plane
CVE-2026-105638
Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and an incorrect code does not increment a counter, invalidate the Redis entry, or lock the email address. The verifier extends django.views.View rather than DRF's APIView, so the configured AnonRateThrottle limit does not apply. The middleware stack also contains no Django-level rate limiter such as django-ratelimit, django-axes, or an IP-throttling middleware. This vulnerability is fixed in 1.4.0.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Makeplane Plane — versions < 1.4.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-105638?
- CVE-2026-105638 is a critical-severity vulnerability in Makeplane Plane, classified under Improper Restriction of Excessive Authentication Attempts. CVSS score: 9.1/10. Published 2026-10-05.
- How severe is CVE-2026-105638?
- Critical severity. CVSS v3 base score is 9.1 out of 10.