CVE-2026-105638
Plane is an open-source project management tool
- Risk score
- 66/100
- CVSS
- 9.1 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 5 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and an incorrect code does not increment a counter, invalidate the Redis entry, or lock the email addr…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.4.0 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.1 critical
- Remotely exploitable without logging in
References
- https://github.com/makeplane/plane/commit/b1c78fe4c832e188454840eb38fd20cd05ef8b0a
- https://github.com/makeplane/plane/pull/9130
- https://github.com/makeplane/plane/releases/tag/v1.4.0
- https://github.com/makeplane/plane/security/advisories/GHSA-mqjv-rwgv-4gxq
- https://github.com/makeplane/plane/security/advisories/GHSA-mqjv-rwgv-4gxq
Original description
Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and an incorrect code does not increment a counter, invalidate the Redis entry, or lock the email address. The verifier extends django.views.View rather than DRF's APIView, so the configured AnonRateThrottle limit does not apply. The middleware stack also contains no Django-level rate limiter such as django-ratelimit, django-axes, or an IP-throttling middleware. This vulnerability is fixed in 1.4.0.
Last activity 5 Oct 2026. Patch Forecast updates every hour.