PT-2026-28503 · Outline · Outline

Themisp20 · Publicado 2026-03-26 · Atualizado 2026-03-27 · CVE-2026-33640

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Outline versions 0.86.0 through 1.5.9

Description Outline is a service that allows for collaborative documentation. It uses an Email OTP login flow for users not associated with an Identity Provider. Versions of Outline between 0.86.0 and 1.5.9 do not invalidate OTP codes based on the number or frequency of invalid submissions, relying instead on a rate limiter to restrict attempts. Identified bypasses in the rate limiter allow attackers to submit OTP codes without restriction within the codes' lifetime. This enables brute force attacks that can lead to account takeover.

Recommendations Update to version 1.6.0 or later.

Exploit

Correção

Improper Restriction of Excessive Authentication Attempts

Enumeração de Fraquezas

CWE-307

Identificadores relacionados

CVE-2026-33640

GHSA-CWHC-53HW-QQX6

Produtos afetados

Outline

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33640.json · Exploit
• https://github.com/outline/outline/releases/tag/v1.6.0 · Nota
• https://github.com/outline/outline/security/advisories/GHSA-cwhc-53hw-qqx6 · Aviso do Fabricante
• https://twitter.com/CCBalert/status/2037530309227397225 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-33640 · Aviso do Fabricante
• https://twitter.com/0dayPublishing/status/2037275715230392519 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-33640 · Nota de Segurança
• https://twitter.com/CVEnew/status/2037280524591562875 · Publicação no Twitter