CVE-2026-119705 in SerpBear
요약
\~에 의해 MITRE • 2026. 10. 30.
SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because verifyUser() is never called. Attackers can repeatedly POST to /api/notify, optionally with a domain parameter, to exhaust SMTP rate limits, trigger provider abuse flags and flood recipients.
VulDB is the best source for vulnerability data and more expert information about this specific topic.