Executive brief
Plane is an open-source project management platform. A security flaw in its login process causes user email addresses to be included in the web browser's address bar during certain error scenarios, such as entering an incorrect login code. This could lead to the exposure of private email addresses to unauthorized parties through browser history, server logs, or third-party analytics tools.
Technical details
An information exposure vulnerability exists in Plane's authentication utility module (packages/utils/src/auth.ts). When the application encounters an error during the 'magic code' authentication flow, it redirects the user while appending their email address as a GET query parameter. This practice violates CWE-598, as sensitive information in query strings can be captured in browser history, web server logs, and HTTP Referer headers sent to external sites. An attacker or unauthorized observer with access to these logs could harvest user identifiers. The issue is resolved in version 1.3.0 by removing PII from the error-handling URL parameters.
Affected products
- makeplane Plane < 1.3.0
Timeline
- 2026-04-07: disclosed
- 2026-04-07: advisory
- 2026-04-07: patched: Fixed in version 1.3.0