Executive brief
cleverange_auth is a Python authentication library used to manage user registration and account verification. A denial-of-service vulnerability in version 0.1.10 allows an attacker to repeatedly create user accounts on any publicly exposed registration endpoint, triggering excessive email generation and database writes that can overwhelm the application's infrastructure, degrade performance for legitimate users, and increase operational costs.
Technical details
The vulnerability is an uncontrolled resource consumption flaw (CWE-400/CWE-770) in the post_save signal handler for the User model in accounts/models.py. When a new User object is created, the signal automatically generates verification records with random codes, renders email templates, and sends verification emails synchronously via SMTP—all without throttling. An unauthenticated remote attacker can exploit this by repeatedly submitting registration requests to a publicly accessible endpoint, triggering excessive database writes, email transmissions, and CPU utilization with no rate limiting or anti-automation controls in place. The attack requires only network access and no authentication or user interaction. An attacker can cause denial of service, inflated infrastructure costs, and service degradation. No patch version is mentioned; mitigation requires application-level controls (rate limiting, CAPTCHA, asynchronous email delivery, IP/email-based registration limits).
Affected products
- cleverange cleverange_auth 0.1.10
Timeline
- 2026-04-27: disclosed: Vulnerability discovered
- 2026-09-01: advisory: CVE-2026-51788 published and advisory released