Read the docs
TI-2026-83180 Aliases CVE-2026-119705GHSA-2j5h-qj2m-vqhp

Missing authentication in SerpBear notification endpoint

Priority LOW 37CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

SerpBear before 3.1.1 lacks authentication on the POST /api/notify endpoint in pages/api/notify.ts, because verifyUser() is never called. A remote unauthenticated attacker can repeatedly send requests to trigger notification emails, which can exhaust SMTP rate limits, trigger provider abuse flags and flood recipients (CWE-306).

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because verifyUser() is never called. Attackers can repeatedly POST to /api/notify, optionally with a domain parameter, to exhaust SMTP rate limits, trigger provider abuse flags and flood recipients.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00626 50th percentileScored 2026-11-07
Fix Fixed serpbear (towfiqi): 3.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Towfiq I.serpbearbefore 3.1.13.1.1Patch availableCNA
  • serpbear VendorTowfiq I. Affected before 3.1.1 Fixed in 3.1.1 Patch available CNA

Remediation

Upgrade towfiqi SerpBear to version 3.1.1.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA serpbear (towfiqi) Fixed in 3.1.1

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-119705
  2. 2026-10-30 CISA SSVC decision points changed
  3. 2026-10-30 Priority changed: MEDIUM → LOW
  4. 2026-10-30 Alias added: GHSA-2j5h-qj2m-vqhp

References

Patch 1

Other 4

  • TI-2024-05368 Triton Lite <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode CVSS 3.1MEDIUM 6.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences