CVE-2026-105638 - Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force
CVE ID :CVE-2026-105638 Published : Oct. 5, 2026, 6:09 p.m. | 1 hour, 18 minutes ago Description :Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code...