# CVE-2026-27949: Makeplane Plane information exposure in authentication flow

Source: https://junglewise.ai/threats/cve-2026-27949-makeplane-plane-information-exposure-in-authentication-flow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-07. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-27949 · Severity: low · CVSS 2 · Published 2026-04-07

Plane is an open-source project management platform. A security flaw in its login process causes user email addresses to be included in the web browser's address bar during certain error scenarios, such as entering an incorrect login code. This could lead to the exposure of private email addresses to unauthorized parties through browser history, server logs, or third-party analytics tools.

Technologies: [Makeplane Plane](https://junglewise.ai/threats/technologies/plane). Vendors: [Makeplane](https://junglewise.ai/threats/vendors/makeplane).

## Quick answers

**Is CVE-2026-27949 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27949 being exploited in the wild.

**How severe is CVE-2026-27949?** Low severity, with a CVSS score of 2, published 7 April 2026.

**Which products and versions are affected?** Makeplane Plane < 1.3.0.

**Is there a fix for CVE-2026-27949?** A patch was published on 2026-04-07: Fixed in version 1.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-27949 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-27949?** Check whether you run Makeplane Plane at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information exposure vulnerability exists in Plane's authentication utility module (packages/utils/src/auth.ts). When the application encounters an error during the 'magic code' authentication flow, it redirects the user while appending their email address as a GET query parameter. This practice violates CWE-598, as sensitive information in query strings can be captured in browser history, web server logs, and HTTP Referer headers sent to external sites. An attacker or unauthorized observer with access to these logs could harvest user identifiers. The issue is resolved in version 1.3.0 by removing PII from the error-handling URL parameters.

## Affected products

- makeplane Plane < 1.3.0

## Timeline

- 2026-04-07: disclosed
- 2026-04-07: advisory
- 2026-04-07: patched: Fixed in version 1.3.0

## References

- [https://github.com/makeplane/plane/security/advisories/GHSA-8rvg-7w43-p2w2](https://github.com/makeplane/plane/security/advisories/GHSA-8rvg-7w43-p2w2)

## Related threats

- [makeplane plane rate limit bypass via X-Forwarded-For header](https://junglewise.ai/threats/cve-2026-111869-a-vulnerability-was-identified-in-makeplane-plane-up-to-1-4-2)
- [Plane account takeover via unverified OAuth email](https://junglewise.ai/threats/cve-2026-105640-plane-is-an-open-source-project-management-tool-prior-to-1-4-0)
- [Plane project management asset IDOR in bulk-asset endpoint](https://junglewise.ai/threats/cve-2026-105637-plane-is-an-open-source-project-management-tool-prior-to-1-4-0)
- [Plane privilege escalation in project member role updates](https://junglewise.ai/threats/cve-2026-105634-plane-is-an-open-source-project-management-tool-prior-to-1-3-0)
- [Plane project management tool asset access control bypass](https://junglewise.ai/threats/cve-2026-105631-plane-is-an-open-source-project-management-tool-prior-to-1-4-0)