Padloc: Authentication bypass through unlimited guessing of email codes
Summary
Padloc, a password manager, contains an authentication bypass in the legacy retrieveMFAToken handler. Wrong email verification codes are not counted toward the attempt limit, so an unauthenticated attacker who knows a victim's email address can brute-force the 6-digit code. A successful guess yields verification tokens that can be used in signup, login and account recovery flows. Self-hosted instances reachable from the internet are at the greatest risk.
Affected
- Padloc 4.0.0 up to but excluding 4.3.1
- Versions before 4.0.0: Unknown.
Fixed in
- Fixed in Padloc 4.3.1
Workaround
- No vendor workaround known. Upgrading to 4.3.1 is the only remedy in the sources.
- Restrict network access to self-hosted instances.
- Ensure rate limiting counts attempts per account, not only per IP address.
Exploitation
- Not known to be exploited in the wild; not listed in CISA KEV.
- No public proof-of-concept found at the time of research.
Our recommendation
- Upgrade self-hosted Padloc servers to 4.3.1 or later.
- Check whether any Padloc instance is reachable from the internet and restrict access if it is not needed.
- Monitor authentication logs for repeated verification attempts against accounts.
- Confirm the fix on a test instance before relying on it.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit: Count failed legacy email MFA verification attempts github.com
- Padloc GitHub security advisory GHSA-3mq5-m2qg-fqhq github.com
- Vulnerable code: v3-compat.ts at v4.3.0 github.com
- VulnCheck advisory: Padloc email MFA code brute force via retrieveMFAToken www.vulncheck.com
- OpenCVE: CVE-2026-126571 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:55.
Original description (NVD)
Padloc 4.0.0 before 4.3.1 contains an authentication bypass vulnerability in the legacy retrieveMFAToken handler that never counts wrong email verification codes toward the attempt limit. Unauthenticated attackers knowing a victim's email can brute force the 6-digit code to obtain verification tokens usable in signup, login and account recovery flows.
NVD references (4)
- https://github.com/padloc/padloc/blob/v4.3.0/packages/core/src/v3-compat.ts#L191-L210
- https://github.com/padloc/padloc/commit/26f292515fe623826070454872f9cee08b756544
- https://github.com/padloc/padloc/security/advisories/GHSA-3mq5-m2qg-fqhq
- https://www.vulncheck.com/advisories/padloc-4.0.0-before-4.3.1-email-mfa-code-brute-force-via-retrievemfatoken
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.