TI-2026-51629 Aliases CVE-2026-73529 GHSA-9fxw-r4jg-3hq3

Plainpad Missing Rate Limiting via POST /v1/sessions

LOW 37CWE-307Published 2026-08-18 · Updated 2026-08-18

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-307.

Summary

Plainpad through 1.1.1, fixed in commit d3823fc, contains a missing rate limiting vulnerability that allows unauthenticated attackers to send unbounded login requests to the POST /v1/sessions endpoint due to dead code in App\Http\Kernel.php that is never instantiated under the Laravel 11+ skeleton, leaving the API throttle configuration unattached to any route. Attackers can exploit this by sending unlimited credential attempts with no lockout or CAPTCHA enforcement, and additionally trigger CPU exhaustion by forcing repeated bcrypt comparisons on each request.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00409 35th percentileScored 2026-11-07

Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
alextselegidis	plainpad	up to 1.1.1	—	Patch available	CNA

plainpad Vendoralextselegidis Affected up to 1.1.1 Fixed in — Patch available CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-73529
2026-10-03 Alias added: GHSA-9fxw-r4jg-3hq3

References

Patch 1

Patch Commit

TI-2023-01200 Use of Hard-coded Credentials in alextselegidis/easyappointments CVSS 3.1CRITICAL 9.8
TI-2026-70736 Easy!Appointments authorization bypass lets attackers modify bookings CVSS 4.0HIGH 8.8
TI-2024-37956 An issue in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to escalate… CVSS 3.1CRITICAL 9.8
TI-2026-19023 CSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeover CVSS 4.0HIGH 7.4
TI-2025-32119 alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection… CVSS 3.1HIGH 8.1
TI-2023-01980 Session Fixation in alextselegidis/easyappointments CVSS 3.1HIGH 8.8

See all 49 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences