Plane: Missing rate limit in magic-code login enables brute force
Summary
Plane, an open-source project management tool, accepts a six-digit numeric code for magic-code email login. The verification endpoint has no per-code failed-attempt counter and is not covered by the configured anonymous rate limit, so wrong guesses are not restricted. An unauthenticated attacker who knows a user's email address can brute-force the code within its validity period and sign in as that user, which bypasses the password and TOTP.
Affected
- Plane versions before 1.4.0
Fixed in
- Plane 1.4.0 (rate limiting and per-token attempt limits for magic-code verification, from PR #9130)
Workaround
Unknown.
Exploitation
- Known exploited: No (not listed in CISA KEV according to the sources).
- CISA SSVC: exploitation status 'poc', automatable 'yes', technical impact 'total'.
- A public write-up describes a brute-force reproducer; the contents were not verified for this entry.
Our recommendation
- Upgrade all self-hosted Plane instances to version 1.4.0 or later.
- Until the upgrade is done, restrict access to the instance (for example VPN, SSO or IP allowlisting) if possible.
- Monitor logs for repeated magic-code sign-in or sign-up requests from the same source.
- Check whether the upgraded version contains the fix described in the official 1.4.0 release notes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub commit b1c78fe (fix: rate-limit magic-code verify) github.com
- GitHub pull request #9130 github.com
- Plane release v1.4.0 github.com
- GitHub Security Advisory GHSA-mqjv-rwgv-4gxq github.com
- OSV entry CVE-2026-105638 osv.dev
- HOL Guard CVE record CVE-2026-105638 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:28.
Original description (NVD)
Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and an incorrect code does not increment a counter, invalidate the Redis entry, or lock the email address. The verifier extends django.views.View rather than DRF's APIView, so the configured AnonRateThrottle limit does not apply. The middleware stack also contains no Django-level rate limiter such as django-ratelimit, django-axes, or an IP-throttling middleware. This vulnerability is fixed in 1.4.0.
NVD references (5)
- https://github.com/makeplane/plane/commit/b1c78fe4c832e188454840eb38fd20cd05ef8b0a
- https://github.com/makeplane/plane/pull/9130
- https://github.com/makeplane/plane/releases/tag/v1.4.0
- https://github.com/makeplane/plane/security/advisories/GHSA-mqjv-rwgv-4gxq
- https://github.com/makeplane/plane/security/advisories/GHSA-mqjv-rwgv-4gxq
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.