Vulnerability in Tandoor Recipes
CVE-2026-33152
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, Tandoor Recipes configures Django REST Framework with BasicAuthentication as one of the default authentication backends. The AllAuth rate limiting configuration (ACCOUNT_RATE_LIMITS: login: 5/m/ip) only applies to the HTML-based login endpoint at /accounts/login/. Any API endpoint that accepts authenticated requests can be targeted via Authorization: Basic headers with zero rate limiting, zero account lockout, and unlimited attempts. An attacker can perform high-speed password guessing against any known username. Version 2.6.0 patches the issue.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.005 (44.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 44th percentile — 44.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: +0.000
Affected products
- Tandoor Recipes
- Tandoorrecipes Recipes — versions < 2.6.0
Weakness classification (CWE)
References
- github.com/TandoorRecipes/recipes/security/advisories/GHSA-7m7c-jjqc-r522 (Exploit, Vendor Advisory)
- github.com/TandoorRecipes/recipes/releases/tag/2.6.0 (Release Notes)
Frequently asked questions
- What is CVE-2026-33152?
- CVE-2026-33152 is a critical-severity vulnerability in Tandoor Recipes, classified under Improper Restriction of Excessive Authentication Attempts. CVSS score: 9.1/10. Published 2026-03-26.
- How severe is CVE-2026-33152?
- Critical severity. CVSS v3 base score is 9.1 out of 10.