CVE-2026-33640 Details
Description
Outline is a service that allows for collaborative documentation. Outline implements an Email OTP login flow for users not associated with an Identity Provider. Starting in version 0.86.0 and prior to version 1.6.0, Outline does not invalidate OTP codes based on amount or frequency of invalid submissions, rather it relies on the rate limiter to restrict attempts. Consequently, identified bypasses in the rate limiter permit unrestricted OTP code submissions within the codes lifetime. This allows attackers to perform brute force attacks which enable account takeover. Version 1.6.0 fixes the issue.
A vulnerability in Outline's email OTP login process for users without an Identity Provider has been identified. In versions 0.86.0 prior to 1.6.0, the application fails to invalidate OTP codes based on the frequency of invalid submissions. Instead, it relies on a rate limiter that can be bypassed, allowing unlimited OTP submissions within the code's 10-minute lifespan. This flaw enables attackers to brute force OTP codes, leading to account takeover.
Users should be advised to update to Outline version 1.6.0, where this vulnerability has been patched. Additionally, implement measures such as capping OTP attempt failures, enabling rate limiting by default, and enforcing account lockout after excessive invalid requests.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/outline/outline/releases/tag/v1.6.0 | [email protected] | Release Notes |
| https://github.com/outline/outline/security/advisories/GHSA-cwhc-53hw-qqx6 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| getoutline outline | >= 0.86.0, < 1.6.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 31, 2026 | Initial Analysis | [email protected] |
| Mar 26, 2026 | New CVE Received | [email protected] |