datacycle-engine dataCycle-CORE up to 25.07.3 JSON login endpoint /api/v4/auth/login excessive authentication

Summaryinfo

A vulnerability labeled as problematic has been found in datacycle-engine dataCycle-CORE up to 25.07.3. Affected by this issue is some unknown functionality of the file /api/v4/auth/login of the component JSON login endpoint. Executing a manipulation can lead to excessive authentication. This vulnerability is handled as CVE-2026-32825. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as problematic was found in datacycle-engine dataCycle-CORE up to 25.07.3. This vulnerability affects an unknown part of the file /api/v4/auth/login of the component JSON login endpoint. The manipulation with an unknown input leads to a excessive authentication vulnerability. The CWE definition for the vulnerability is CWE-307. The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks. As an impact it is known to affect confidentiality. CVE summarizes:

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the browser login flow and the JSON login endpoint. The source code enables Devise's `:lockable` module on the user model but explicitly disables both lock and unlock strategies, and no request throttling or rate-limiting layer was identified in the Rails code. This creates a direct online password-guessing risk: - valid user accounts can be attacked continuously without temporary lockout - the same weakness is reachable through both `/users/sign_in` and `/api/v4/auth/login` - successful guessing yields a normal session cookie in the HTML flow or a fresh JWT in the API flow - the API endpoint is especially attractive for automation because it requires no CSRF token This has been patched in version 26.06.08.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-32825 since 03/16/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1110.001.

Upgrading to version 26.06.08 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• datacycle-engine

Name

• dataCycle-CORE

Version

• 25.07.0
• 25.07.1
• 25.07.2
• 25.07.3

Website

• Product: https://github.com/datacycle-engine/dataCycle-CORE/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion