CVE-2026-56450: AIL Project AIL framework brute force in 2FA verification

CVE-2026-56450 · Severity: info · CVSS 5.1 · Published 2026-06-22

The AIL framework, a platform for analyzing information leaks, failed to limit the number of times a user could guess a two-factor authentication (2FA) code. This allowed an attacker who already knew a user's password to repeatedly guess the secondary security code until they gained full access to the account. A security update has been released that locks accounts after 30 failed attempts to prevent this type of automated guessing.

Technologies: Ail-Project AIL framework. Vendors: Ail-Project.

Quick answers

Is CVE-2026-56450 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-56450 being exploited in the wild.
How severe is CVE-2026-56450?
Informational severity, with a CVSS score of 5.1, published 22 June 2026.
Which products and versions are affected?
Ail-Project AIL framework <= 6.8.0.
Is there a fix for CVE-2026-56450?
A patch was published on 2026-06-22: Fix committed to AIL framework repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56450 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-56450?
Check whether you run Ail-Project AIL framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

AIL framework (up to version 6.8.0) contains an improper restriction of excessive authentication attempts (CWE-307) within its 2FA verification logic. While the system may have had protections for initial password entry, it lacked rate-limiting or account lockout mechanisms for the One-Time Password (OTP) stage. An attacker who has successfully completed the first stage of authentication (password) can submit an unlimited number of OTP guesses via the network. This allows for successful brute-force attacks against the 2FA requirement. The vulnerability is addressed in the AIL framework commit d3a394f, which implements a lockout of one hour after 30 failed OTP attempts.

Affected products

  • AIL Project AIL framework <= 6.8.0

Timeline

  • 2026-06-22: disclosed
  • 2026-06-22: patched: Fix committed to AIL framework repository
  • 2026-06-22: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.