Outline up to 1.5.x Submission excessive authentication

Summaryinfo

A vulnerability was found in Outline up to 1.5.x. It has been classified as problematic. Affected is an unknown function of the component Submission Handler. Performing a manipulation results in excessive authentication. This vulnerability is known as CVE-2026-33640. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Outline up to 1.5.x. It has been classified as critical. This affects an unknown code block of the component Submission Handler. The manipulation with an unknown input leads to a excessive authentication vulnerability. CWE is classifying the issue as CWE-307. The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Outline is a service that allows for collaborative documentation. Outline implements an Email OTP login flow for users not associated with an Identity Provider. Starting in version 0.86.0 and prior to version 1.6.0, Outline does not invalidate OTP codes based on amount or frequency of invalid submissions, rather it relies on the rate limiter to restrict attempts. Consequently, identified bypasses in the rate limiter permit unrestricted OTP code submissions within the codes lifetime. This allows attackers to perform brute force attacks which enable account takeover. Version 1.6.0 fixes the issue.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-33640 since 03/23/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1110.001 according to MITRE ATT&CK.

Upgrading to version 1.6.0 eliminates this vulnerability. The upgrade is hosted for download at github.com.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Outline

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5

Website

• Product: https://github.com/outline/outline/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion