Makeplane Plane up to 1.3.x Magic-Code Email Login entropy

Summaryinfo

A vulnerability was found in Makeplane Plane up to 1.3.x. It has been classified as problematic. The affected element is an unknown function of the component Magic-Code Email Login. The manipulation leads to entropy. This vulnerability is referenced as CVE-2026-105638. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Makeplane Plane up to 1.3.x. This issue affects an unknown code block of the component Magic-Code Email Login. The manipulation with an unknown input leads to a entropy vulnerability. Using CWE to declare the problem leads to CWE-331. The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others. Impacted is confidentiality. The summary by CVE is:

Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and an incorrect code does not increment a counter, invalidate the Redis entry, or lock the email address. The verifier extends django.views.View rather than DRF's APIView, so the configured AnonRateThrottle limit does not apply. The middleware stack also contains no Django-level rate limiter such as django-ratelimit, django-axes, or an IP-throttling middleware. This vulnerability is fixed in 1.4.0.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-105638 since 10/05/2026. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1600.001 for this issue.

Upgrading to version 1.4.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Makeplane

Name

• Plane

Version

• 1.0
• 1.1
• 1.2
• 1.3

Website

• Product: https://github.com/makeplane/plane/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion