Is CVE-2026-105638 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105638 being exploited in the wild.

How severe is CVE-2026-105638?

Critical severity, with a CVSS score of 9.1, published 5 October 2026.

Is there a fix for CVE-2026-105638?

Yes: fixed in 1.4.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-105638 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-105638?

Check whether you run Plane at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105638: Plane magic-code OTP brute-force in email login

CVE-2026-105638 · Severity: critical · CVSS 9.1 · Published 2026-10-05

Plane is an open-source project management and collaboration tool. Its magic-link email login feature generates six-digit numeric codes that lack rate limiting and attempt counting, allowing an attacker to brute-force the code and gain unauthorized access to any user account if they know the email address. This vulnerability enables account takeover without requiring a password.

Technologies: Plane. Vendors: Plane.

Quick answers

Is CVE-2026-105638 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105638 being exploited in the wild.
How severe is CVE-2026-105638?: Critical severity, with a CVSS score of 9.1, published 5 October 2026.
Which products and versions are affected?: Plane before 1.4.0.
Is there a fix for CVE-2026-105638?: Yes: fixed in 1.4.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105638 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-105638?: Check whether you run Plane at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.4.0

Technical details

The magic-code email login uses a six-digit numeric OTP (~20 bits entropy) with a 600-second TTL, but the verification endpoint does not increment failed-attempt counters and does not inherit DRF's rate throttling because it extends django.views.View rather than APIView. Combined with the lack of per-IP rate limiting, an unauthenticated attacker can exhaust the ~900k code space within the TTL window. The fix caps verification attempts to 5 per token and applies authentication-level rate throttling.

Affected products

Plane Plane before 1.4.0

Timeline

2026-10-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.