PT-2026-28471 · Unknown · Tandoor Recipes

Filipegaudard · Published 2026-03-26 · Updated 2026-03-26 · CVE-2026-33152

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Tandoor Recipes versions prior to 2.6.0

Description Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Versions prior to 2.6.0 configure Django REST Framework with BasicAuthentication as a default authentication backend. The AllAuth rate limiting configuration only applies to the HTML-based login endpoint at /accounts/login/. Any API endpoint accepting authenticated requests can be targeted via Authorization: Basic headers without rate limiting, account lockout, or attempt limits. An attacker can perform high-speed password guessing against any known username. The vulnerable API endpoints are susceptible to brute-force attacks due to the lack of rate limiting on the BasicAuthentication method.

Recommendations Update Tandoor Recipes to version 2.6.0 or later.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2026-33152

GHSA-7M7C-JJQC-R522

Affected Products

Tandoor Recipes

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33152.json · Exploit
• https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-7m7c-jjqc-r522 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33152 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33152 · Vendor Advisory
• https://github.com/TandoorRecipes/recipes/releases/tag/2.6.0 · Note
• https://twitter.com/CveFindCom/status/2037253992074424360 · Twitter Post
• https://twitter.com/0dayPublishing/status/2037249324355104912 · Twitter Post
• https://twitter.com/CVEnew/status/2037280586000466006 · Twitter Post
• https://twitter.com/TheHackerWire/status/2037273346778554626 · Twitter Post