CVE Intelligence
Analysis AI-assisted

CVE-2026-105638: Plane magic-code login: missing limit on failed attempts

Plane, an open-source project management tool, has a weakness in its magic-code email login in versions before 1.4.0. The six-digit one-time code can be tested repeatedly because failed attempts are not counted, limited, or locked out. The GitHub CNA rates it critical with CVSS 3.1 score 9.1, and it is fixed in 1.4.0; no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Plane is an open-source project management tool. According to the GitHub advisory GHSA-mqjv-rwgv-4gxq, versions before 1.4.0 use a six-digit numeric code for the magic-code email login, and the verifier does not limit failed attempts. The weakness is classified as CWE-307, improper restriction of excessive authentication attempts.

Impact

  • The CVSS 3.1 vector in the record indicates network attack with no privileges or user interaction, high confidentiality and integrity impact, and no availability impact.
  • Inference: repeated guessing of login codes could allow an attacker to sign in as another user, but the sources do not describe a demonstrated account takeover.

Affected products and versions

  • The record describes Plane versions before 1.4.0 as affected. The lower bound of the affected range is unknown because the structured affected list in the record is empty.
  • The fix is described as present in 1.4.0, referenced in the v1.4.0 release.

Exploitation status

The CVE is not listed in the CISA KEV catalog in the record. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00384 with percentile 0.30549 as of 2026-10-13. This is a statistical estimate and not evidence of exploitation.

Remediation and mitigation

  • Upgrade Plane to version 1.4.0 or later, as described by the project.
  • Until the upgrade is applied, limit exposure of the instance where feasible and consider restricting access to the email login path.
  • Inference: rate limiting or lockout controls at a reverse proxy or web application firewall may reduce risk while patching, but these are not described in the advisory.

Detection guidance

  • Review authentication logs for unusually high numbers of failed magic-code verifications, grouped by source IP address or by target email address.
  • Check whether bursts of failed attempts are followed by successful logins and review those accounts.
  • Log availability depends on the deployment and may need to be enabled.

Limitations of the available information

  • The structured affected and fixes lists in the record are empty, so version details come from the description and release references.
  • The record shows a source status of Deferred.
  • The record does not include patch code analysis, exploitation telemetry beyond the KEV and EPSS fields, or the lower bound of affected versions.

Frequently asked questions

Is this vulnerability fixed?

The record states that it is fixed in version 1.4.0. Upgrade Plane to 1.4.0 or later and review the release and advisory for details.

Is this CVE being actively exploited?

The CVE is not listed in CISA KEV in the record, and no confirmed exploitation appears in the sources consulted. The EPSS value is an estimate, not evidence of exploitation.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.