CVE-2026-105127: LaraDashboard DOS Vulnerability

CVE-2026-105127 Overview

CVE-2026-105127 is a resource exhaustion vulnerability [CWE-770] in LaraDashboard versions 1.4.2 before 1.4.8. The application applies advanced email validation to unauthenticated forgot-password and reset-password endpoints. Each submission triggers a Domain Name System (DNS) lookup and a paid AbstractAPI verification request. Unauthenticated attackers can submit arbitrary email addresses to exhaust the verification quota, causing validation to fail open across every public form. Attackers can also use the DNS lookups to probe domain resolution behavior from the server.

Critical Impact
Unauthenticated attackers can exhaust third-party email verification quotas and degrade availability of email validation across all public forms in LaraDashboard.

Affected Products

LaraDashboard 1.4.2 through 1.4.7
LaraDashboard ForgotPasswordRequest endpoint
LaraDashboard ResetPasswordRequest endpoint

Discovery Timeline

2026-10-04 - CVE-2026-105127 published to the National Vulnerability Database (NVD)
2026-10-05 - Last updated in NVD database

Technical Details for CVE-2026-105127

Vulnerability Analysis

The vulnerability resides in LaraDashboard's authentication request classes. Both ForgotPasswordRequest.php and ResetPasswordRequest.php enable the includeAdvancedEmailValidation path by passing emailFields: ['email'] to the validation routine. The advanced validation workflow invokes EmailDomainCheckService for DNS resolution and EmailVerificationService for an outbound call to AbstractAPI.

Because these endpoints accept unauthenticated input, any remote user can trigger the paid verification service. Repeated submissions consume the account's quota. Once the quota is exhausted, the validator fails open and allows unverified addresses through every public form that relies on the same service.

Root Cause

The root cause is unbounded consumption of a finite, external resource reachable from an unauthenticated code path. The design places paid, third-party verification inside pre-authentication request validation without rate limiting, caching, or quota accounting.

Attack Vector

An attacker sends HyperText Transfer Protocol (HTTP) POST requests to /forgot-password or /reset-password with arbitrary email values in the email field. Each request issues a DNS query and consumes one AbstractAPI credit. Automated submissions deplete the quota and provide a probe for whether specific domains resolve from the server's network perspective.

php

// Patch from app/Http/Requests/Auth/ForgotPasswordRequest.php
            [
                'email' => ['required', 'email'],
            ],
-            emailFields: ['email'],
+            includeAdvancedEmailValidation: false,
        );
    }
}
// Source: https://github.com/laradashboard/laradashboard/commit/8babc803066a74c628fa012928fb1e6591411eba

The patch replaces the emailFields argument with includeAdvancedEmailValidation: false, disabling DNS and AbstractAPI calls on the pre-authentication path. The same change is applied to ResetPasswordRequest.php.

Detection Methods for CVE-2026-105127

Indicators of Compromise

High request volume to /forgot-password or /reset-password from a single source or distributed set of sources.
Spikes in outbound DNS queries from the application host correlated with password recovery traffic.
AbstractAPI quota alerts, billing anomalies, or sudden shift to fail-open validation responses.

Detection Strategies

Correlate HTTP access logs for password recovery endpoints against AbstractAPI call volume to identify abuse patterns.
Inspect application logs for repeated submissions of malformed, non-existent, or sequential email addresses.
Baseline normal recovery request rates and alert on deviations exceeding expected user behavior.

Monitoring Recommendations

Instrument the LaraDashboard application host to track DNS query volume and AbstractAPI response codes.
Forward web server, application, and third-party API usage logs to a central analytics pipeline for correlation.
Alert on quota depletion events reported by AbstractAPI billing or usage dashboards.

How to Mitigate CVE-2026-105127

Immediate Actions Required

Upgrade LaraDashboard to version 1.4.8 or later, which disables advanced email validation on password recovery endpoints.
Apply rate limiting at the web server or Web Application Firewall (WAF) layer to /forgot-password and /reset-password.
Rotate AbstractAPI credentials if quota exhaustion or billing anomalies are observed.

Patch Information

The fix is delivered in Laradashboard Release v1.4.8 via GitHub Pull Request #339 and commit 8babc80. Additional context is published in GHSA-5hq2-r2f3-9vp9, GHSA-v36p-8578-8gch, and the VulnCheck Advisory for Laradashboard.

Workarounds

Manually patch ForgotPasswordRequest.php and ResetPasswordRequest.php to pass includeAdvancedEmailValidation: false.
Place strict per-IP and per-session rate limits on all unauthenticated endpoints that invoke email verification.
Introduce CAPTCHA or proof-of-work challenges on password recovery flows to raise the cost of automated abuse.

bash

# Example Nginx rate limit for password recovery endpoints
limit_req_zone $binary_remote_addr zone=pwreset:10m rate=5r/m;

location ~ ^/(forgot-password|reset-password)$ {
    limit_req zone=pwreset burst=5 nodelay;
    proxy_pass http://laradashboard_upstream;
}