CVE-2026-71213
Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account, including administrators, with no throttling.
- Affected products
- Typemill
- CVSS 3.1
- 9.1 CRITICAL
- EPSS
- 0.3% (25th percentile)
- Weakness
- CWE-307
- NVD status
- Received
- Published
- 2026-08-05
CVE-2026-71213 at NVD
No indexed exploits for CVE-2026-71213 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-71213 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.