PLANKA 2.2.0 through 2.2.1 TOTP Brute Force via verify-totp Endpoint

Advisories

PLANKA 2.2.0 through 2.2.1 TOTP Brute Force via verify-totp Endpoint

severity: critical
date: 10/6/2026
Affecting: planka >= 2.2.0, <= 2.2.1
CVE: CVE-2026-105835
CWE: CWE-307 Improper Restriction of Excessive Authentication Attempts
CVSS: 9.1
CVSS V4 Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References: Patch Commit
verify-totp controller at v2.2.1
https://github.com/plankanban/planka
Credit: Eldor Nabijonov
Description: PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one succeeds, obtaining a full access token.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo