PT-2026-28503 · Outline · Outline

Themisp20 · Published 2026-03-26 · Updated 2026-03-27 · CVE-2026-33640

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Outline versions 0.86.0 through 1.5.9

Description Outline is a service that allows for collaborative documentation. It uses an Email OTP login flow for users not associated with an Identity Provider. Versions of Outline between 0.86.0 and 1.5.9 do not invalidate OTP codes based on the number or frequency of invalid submissions, relying instead on a rate limiter to restrict attempts. Identified bypasses in the rate limiter allow attackers to submit OTP codes without restriction within the codes' lifetime. This enables brute force attacks that can lead to account takeover.

Recommendations Update to version 1.6.0 or later.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2026-33640

GHSA-CWHC-53HW-QQX6

Affected Products

Outline

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33640.json · Exploit
• https://github.com/outline/outline/security/advisories/GHSA-cwhc-53hw-qqx6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33640 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33640 · Security Note
• https://github.com/outline/outline/releases/tag/v1.6.0 · Note
• https://twitter.com/CCBalert/status/2037530309227397225 · Twitter Post
• https://twitter.com/0dayPublishing/status/2037275715230392519 · Twitter Post
• https://twitter.com/CVEnew/status/2037280524591562875 · Twitter Post