CVE-2026-71213 Details
Description
Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account, including administrators, with no throttling.
A vulnerability exists in Typemill's login endpoint, specifically in versions prior to 2.25.0, where the system fails to implement rate-limiting, count failed attempts, or lock accounts when captcha is disabled, which is the default setting. This oversight allows an unauthenticated attacker to send an unlimited number of password-guessing requests to any account, including those of administrators, without any delay. The only existing attempt-counting and lockout mechanism in this file is related to an optional secondary email-authentication step and does not apply to the primary password verification.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/typemill/typemill | TuranSec | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| Typemill | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | TuranSec |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | TuranSec |