PT-2026-28471 · Unknown · Tandoor Recipes

Filipegaudard · Publicado 2026-03-26 · Atualizado 2026-03-26 · CVE-2026-33152

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Tandoor Recipes versions prior to 2.6.0

Description Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Versions prior to 2.6.0 configure Django REST Framework with BasicAuthentication as a default authentication backend. The AllAuth rate limiting configuration only applies to the HTML-based login endpoint at /accounts/login/. Any API endpoint accepting authenticated requests can be targeted via Authorization: Basic headers without rate limiting, account lockout, or attempt limits. An attacker can perform high-speed password guessing against any known username. The vulnerable API endpoints are susceptible to brute-force attacks due to the lack of rate limiting on the BasicAuthentication method.

Recommendations Update Tandoor Recipes to version 2.6.0 or later.

Exploit

Correção

Improper Restriction of Excessive Authentication Attempts

Enumeração de Fraquezas

CWE-307

Identificadores relacionados

CVE-2026-33152

GHSA-7M7C-JJQC-R522

Produtos afetados

Tandoor Recipes

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33152.json · Exploit
• https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-7m7c-jjqc-r522 · Aviso do Fabricante
• https://github.com/TandoorRecipes/recipes/releases/tag/2.6.0 · Nota
• https://twitter.com/CveFindCom/status/2037253992074424360 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-33152 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-33152 · Aviso do Fabricante
• https://twitter.com/0dayPublishing/status/2037249324355104912 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2037280586000466006 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2037273346778554626 · Publicação no Twitter