CVE-2026-71213: Typemill Authentication Bypass Vulnerability

CVE-2026-71213 Overview

CVE-2026-71213 is a missing brute-force protection flaw in Typemill's authentication controller. The login endpoint at POST /tm/login, handled by ControllerWebAuth::login(), enforces no rate limiting, no failed-attempt counter, and no account lockout when captcha is disabled. Captcha is disabled by default, so out-of-the-box deployments are exposed. An unauthenticated attacker can issue unlimited password-guessing requests against any account, including administrator accounts. The existing attempt-counting logic in the same file guards only an optional secondary email authcode step and does not cover the primary password check. This vulnerability is classified under [CWE-307: Improper Restriction of Excessive Authentication Attempts].

Critical Impact
Unauthenticated attackers can perform unthrottled credential brute-force attacks against Typemill administrator accounts, leading to full site takeover.

Affected Products

Typemill CMS (default installations with captcha disabled)
The ControllerWebAuth::login() handler serving POST /tm/login
Any Typemill account, including administrator accounts, reachable over the network

Discovery Timeline

2026-08-05 - CVE-2026-71213 published to the National Vulnerability Database (NVD)
2026-08-05 - Last updated in the NVD database

Technical Details for CVE-2026-71213

Vulnerability Analysis

Typemill is a flat-file content management system written in PHP. Authentication is handled by ControllerWebAuth::login(), which processes credentials submitted to POST /tm/login. The controller validates the supplied username and password against stored credentials and issues a session on success. It returns a generic failure response on mismatch without recording the attempt or applying any delay.

Because the primary password check has no throttling, an attacker can send credential-guessing requests as fast as the server can process them. There is no lockout after repeated failures and no exponential backoff. Captcha, which could break automated attempts, is disabled in the shipped default configuration.

The attack requires only network reachability to the login endpoint. No prior authentication or user interaction is needed. Successful exploitation grants full account access, and administrator compromise leads to full CMS takeover including content modification and potential code execution through CMS features.

Root Cause

The root cause is missing enforcement of authentication attempt limits on the primary password path in ControllerWebAuth::login(). Attempt-counting and lockout logic exists in the same file but is scoped to an optional secondary email authcode step. The password check bypasses that logic entirely, and the captcha mechanism that might otherwise deter automation is off by default.

Attack Vector

Exploitation uses the network-facing HTTP interface. An attacker scripts POST /tm/login requests with a target username and iterates through a password dictionary. Because no server-side counter increments on failure and no delay is imposed, throughput is bounded only by network and server capacity. Distributed guessing across source IPs further evades any perimeter controls. Refer to the Typemill GitHub repository for source code context.

Detection Methods for CVE-2026-71213

Indicators of Compromise

High volume of POST /tm/login requests from a single source IP or a rotating set of IPs within a short window
Repeated HTTP 200 or redirect responses to /tm/login following bursts of failure responses, indicating a successful guess
Web server access logs showing sequential login attempts for the same username with varying password payloads
Unexpected administrator session activity or content changes immediately after a burst of login traffic

Detection Strategies

Aggregate web access logs and alert on request-rate thresholds against /tm/login per source IP and per target username
Correlate failed-login response patterns with subsequent successful authentication events to identify successful brute-force outcomes
Deploy a Web Application Firewall (WAF) rule to count and score authentication attempts against the endpoint

Monitoring Recommendations

Forward Typemill and reverse-proxy access logs to a centralized SIEM or data lake for retention and rate-based analytics
Monitor administrator login sources for new geolocations, autonomous systems, or user-agent strings
Baseline normal login volume for the site and alert on deviations exceeding the baseline

How to Mitigate CVE-2026-71213

Immediate Actions Required

Enable the built-in captcha option in Typemill's authentication settings to break automated request loops
Place /tm/login behind a reverse proxy or WAF that enforces per-IP and per-username request-rate limits
Restrict access to /tm/login to trusted management networks or VPN ranges where operationally feasible
Rotate administrator passwords and enforce long, high-entropy values that resist dictionary attacks

Patch Information

No vendor patch reference is listed in the NVD entry for CVE-2026-71213 at publication. Track the Typemill GitHub repository for upcoming releases that add rate limiting, failed-attempt counting, and lockout to the primary password path in ControllerWebAuth::login().

Workarounds

Turn captcha on in the Typemill configuration; do not rely on the default state
Terminate TLS at a reverse proxy such as nginx or Caddy and apply a request-rate limit to /tm/login
Use fail2ban or an equivalent log-based tool to ban source IPs that exceed a failed-login threshold
Require an additional network-layer authentication factor, such as HTTP basic auth at the proxy, in front of the login page

bash

# Example nginx rate-limit for the Typemill login endpoint
limit_req_zone $binary_remote_addr zone=tmlogin:10m rate=5r/m;

server {
    location = /tm/login {
        limit_req zone=tmlogin burst=5 nodelay;
        proxy_pass http://127.0.0.1:8080;
    }
}