CVE-2026-129161 in free-fs
Summary
by MITRE • 11/13/2026
Dromara free-fs 2.0.1 through 2.3.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute-force six-digit password reset codes via PUT /apis/user/forget-password. Attackers can request a code for a known email and submit unlimited guesses during its 300-second lifetime to set a chosen password and take over the account.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/13/2026
The vulnerability identified in Dromara free-fs versions 2.0.1 through 2.3.1 represents a critical failure in access control mechanisms, specifically categorized under CWE-307 as Improper Restriction of Excessive Authentication Attempts. This flaw resides within the password reset functionality exposed via the PUT /apis/user/forget-password endpoint. The core technical deficiency lies in the absence of rate limiting or account lockout policies for the verification code submission process. While the system correctly generates a six-digit numeric code and associates it with a specific email address, it fails to enforce any constraints on how many times that code can be guessed within its validity window. This architectural oversight allows an attacker who has identified a valid user email to exploit the predictable nature of short numerical codes combined with unlimited retry attempts.
From an operational perspective, this vulnerability enables account takeover through brute-force attacks. The six-digit password reset code provides only one million possible combinations (000000 to 999999). Given that modern computing resources can perform millions of HTTP requests per second, the probability of guessing a correct code within the thirty-second window is effectively near certainty for an automated attacker. Unlike traditional brute-force attacks on login pages which are often mitigated by CAPTCHAs or temporary account locks after a few failed attempts, this vulnerability bypasses such defenses entirely because each guess is treated as a valid submission until success occurs. The attacker does not need to know the user's password initially; they only require knowledge of the associated email address, which may be publicly available through social engineering, data breaches, or simple enumeration if other parts of the application are vulnerable to information disclosure.
The impact of this vulnerability extends beyond individual account compromise. Successful exploitation allows an attacker to assume full control over a user's identity within the Dromara free-fs ecosystem. This can lead to unauthorized access to personal data, financial transactions if applicable, and further lateral movement within connected systems that trust these credentials. In enterprise environments, compromised accounts can be used as footholds for more sophisticated attacks such as privilege escalation or phishing campaigns against other users who trust the compromised account. The lack of authentication restrictions transforms a standard password recovery feature into a direct vector for identity theft, undermining the fundamental security principle of least privilege and proper access control enforcement.
To mitigate this vulnerability, immediate remediation should focus on implementing robust rate limiting mechanisms at both the application layer and infrastructure level. Application-level controls must include locking the specific user account or resetting the session token after a small number of incorrect guesses, typically three to five attempts, rather than allowing unlimited submissions. Additionally, introducing CAPTCHA challenges before generating new reset codes can significantly increase the cost for automated attackers by requiring human interaction. Infrastructure-level protections such as Web Application Firewalls should be configured to detect and block rapid-fire requests from single IP addresses targeting this endpoint. Furthermore, extending the length of password reset tokens or using cryptographically secure random strings instead of simple numeric sequences would exponentially increase the complexity required for successful brute-force attacks, although rate limiting remains the primary defense against excessive authentication attempts as defined by industry standards like OWASP and MITRE ATT&CK technique T1110.