PLANKA: Brute force of two-factor authentication codes via verify-totp endpoint
Summary
PLANKA 2.2.0 through 2.2.1 does not limit incorrect TOTP codes submitted to the verify-totp API endpoint. An attacker who knows a user's password can reuse the ten-minute pending token to guess six-digit codes until one is accepted, obtaining a full access token. The flaw only matters where two-factor authentication is enabled and the instance is reachable by the attacker.
Affected
- PLANKA 2.2.0 through 2.2.1 (Community edition, per the CVE record and OSV)
- Default configuration is unaffected according to the CVE record; deployments with TOTP enabled are relevant
Fixed in
Unknown. The vendor has not confirmed the fixed release. A commit (de4d768) is referenced as the patch but its release is unverified. Do not assume 2.2.1 is fixed.
Workaround
- No vendor-documented workaround found.
- Rate-limit requests to /api/access-tokens/verify-totp at the reverse proxy and alert on repeated failures.
- Restrict access to the instance with VPN or IP allowlisting where possible.
Exploitation
- No confirmed exploitation known. CISA SSVC lists exploitation as none and automatable as no.
- A public proof of concept is unconfirmed.
- EPSS score is 0.00317.
Our recommendation
- Check whether PLANKA is internet-exposed and whether TOTP is enabled for users.
- Apply rate limiting or Fail2Ban rules on the verify-totp endpoint now.
- Enforce strong passwords and monitor logs for repeated failed TOTP attempts.
- Upgrade to the latest release once the vendor confirms the fixed version, and check its release notes for the TOTP fix.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- NVD/CVE record references: PLANKA repository github.com
- VulnCheck advisory www.vulncheck.com
- verify-totp.js at v2.2.1 github.com
- Commit de4d768 (referenced patch, unverified) github.com
- OSV entry CVE-2026-105835 osv.dev
- PLANKA v2.2.1 release github.com
- PLANKA authentication error documentation docs.planka.cloud
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:27.
Original description (NVD)
PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one succeeds, obtaining a full access token.
NVD references (4)
- https://github.com/plankanban/planka
- https://github.com/plankanban/planka/blob/v2.2.1/server/api/controllers/access-tokens/verify-totp.js
- https://github.com/plankanban/planka/commit/de4d7688317829e2a0b665fe9dbf39eaf127b6f9
- https://www.vulncheck.com/advisories/planka-2.2.0-through-2.2.1-totp-brute-force-via-verify-totp-endpoint
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.