CVE-2026-33152: Tandoor Recipes Auth Bypass Vulnerability

CVE-2026-33152 Overview

Tandoor Recipes is an open-source application for managing recipes, planning meals, and building shopping lists. A critical authentication bypass vulnerability exists in versions prior to 2.6.0 where the application configures Django REST Framework with BasicAuthentication as one of the default authentication backends without implementing proper rate limiting protections.

The AllAuth rate limiting configuration (ACCOUNT_RATE_LIMITS: login: 5/m/ip) only applies to the HTML-based login endpoint at /accounts/login/. This leaves all API endpoints that accept authenticated requests via Authorization: Basic headers completely unprotected against brute force attacks. An attacker can perform high-speed password guessing against any known username with zero rate limiting, zero account lockout, and unlimited attempts.

Critical Impact

Attackers can conduct unlimited brute force password attacks against any user account through API endpoints, potentially compromising user credentials and gaining unauthorized access to personal recipe data, meal plans, and shopping lists.

Affected Products

• Tandoor Recipes versions prior to 2.6.0
• Django REST Framework deployments using BasicAuthentication without additional rate limiting
• Self-hosted Tandoor Recipes instances exposed to the internet

Discovery Timeline

• 2026-03-26 - CVE CVE-2026-33152 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33152

Vulnerability Analysis

This vulnerability represents a classic case of improper restriction of excessive authentication attempts (CWE-307). The root issue stems from an inconsistent security configuration where rate limiting protections were applied to the web-based login form but not to the API authentication layer.

When Tandoor Recipes is deployed, Django REST Framework is configured to accept BasicAuthentication on API endpoints. While the /accounts/login/ endpoint benefits from AllAuth's rate limiting (5 attempts per minute per IP), the API endpoints accepting Authorization: Basic headers have no such protection. This creates a significant attack surface where an adversary can bypass the rate limiting entirely by targeting API endpoints instead of the web form.

The vulnerability allows network-based attacks without requiring any prior authentication or user interaction. A successful exploitation could lead to unauthorized access to user accounts, potentially exposing sensitive personal data including recipes, meal plans, and shopping lists stored within the application.

Root Cause

The vulnerability originates from an incomplete security implementation in Tandoor Recipes' authentication configuration. The developers implemented rate limiting through Django AllAuth for the traditional web login flow but failed to extend similar protections to the Django REST Framework API authentication layer. This oversight left BasicAuthentication exposed on all API endpoints without any mechanism to throttle or block repeated authentication failures.

Attack Vector

An attacker can exploit this vulnerability through a network-based brute force attack targeting API endpoints. The attack requires knowledge of a valid username but can be executed from any network location with access to the Tandoor Recipes instance. The attacker sends repeated authentication requests with Authorization: Basic headers containing base64-encoded username:password combinations.

Since there is no rate limiting on API endpoints, an attacker can attempt thousands of password combinations per second, significantly increasing the likelihood of successfully guessing weak passwords. The attack leaves no lockout mechanism to protect accounts, making even moderately complex passwords vulnerable over time.

Detection Methods for CVE-2026-33152

Indicators of Compromise

• High volume of API requests with Authorization: Basic headers from single IP addresses
• Repeated authentication failures in Django REST Framework logs for specific usernames
• Unusual patterns of API access outside normal application usage hours
• Multiple failed authentication attempts followed by successful login from same source

Detection Strategies

• Implement logging and alerting for failed authentication attempts on API endpoints
• Monitor for anomalous request rates to API endpoints requiring authentication
• Deploy web application firewall (WAF) rules to detect and block brute force patterns
• Review server access logs for high-frequency requests to authenticated API routes

Monitoring Recommendations

• Enable detailed authentication logging in Django REST Framework configuration
• Configure SIEM alerts for threshold-based detection of repeated auth failures
• Implement IP reputation monitoring for sources of authentication requests
• Establish baseline metrics for normal API authentication patterns to identify anomalies

How to Mitigate CVE-2026-33152

Immediate Actions Required

• Upgrade Tandoor Recipes to version 2.6.0 or later immediately
• Review authentication logs for signs of brute force attempts that may have occurred
• Enforce password resets for any accounts that show suspicious authentication activity
• Consider temporarily disabling BasicAuthentication if upgrade is not immediately possible

Patch Information

The vulnerability has been addressed in Tandoor Recipes version 2.6.0. Users should upgrade to this version or later to receive the security fix. For detailed information about the patch, refer to the GitHub Release Notes for version 2.6.0 and the GitHub Security Advisory GHSA-7m7c-jjqc-r522.

Workarounds

• Implement Django REST Framework throttling classes to rate limit API authentication attempts
• Deploy a reverse proxy with rate limiting capabilities in front of the application
• Restrict network access to the Tandoor Recipes instance using firewall rules
• Enable multi-factor authentication if available to reduce impact of compromised passwords

# Example: Add rate limiting via reverse proxy (nginx)
# Add to nginx server block configuration
limit_req_zone $binary_remote_addr zone=api_auth:10m rate=5r/s;

location /api/ {
    limit_req zone=api_auth burst=10 nodelay;
    proxy_pass http://tandoor_backend;
}