CVE-2026-73529: Plainpad Missing Rate Limiting Vulnerability

CVE-2026-73529 Overview

CVE-2026-73529 is a missing rate limiting vulnerability [CWE-307] in Plainpad through version 1.1.1. The flaw exists because the App\Http\Kernel.php file contains dead code that is never instantiated under the Laravel 11+ skeleton. As a result, the API throttle configuration remains unattached to any route. Unauthenticated attackers can send unbounded login requests to the POST /v1/sessions endpoint. The absence of lockout mechanisms or CAPTCHA enforcement enables credential brute-force attempts and CPU exhaustion through repeated bcrypt comparisons. The issue is fixed in commit d3823fc.

Critical Impact

Attackers can conduct unlimited credential guessing against the login endpoint while simultaneously exhausting server CPU resources via forced bcrypt operations.

Affected Products

• Plainpad through version 1.1.1
• Deployments running the Laravel 11+ skeleton without a custom HTTP Kernel
• Instances predating commit d3823fc

Discovery Timeline

• 2026-08-18 - CVE-2026-73529 published to NVD
• 2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-73529

Vulnerability Analysis

Plainpad ships an App\Http\Kernel.php class intended to register middleware groups, including API throttling. Under the Laravel 11+ application skeleton, the framework no longer instantiates this legacy Kernel class. The middleware definitions in the file become dead code that never binds to any incoming route. The POST /v1/sessions login endpoint therefore accepts an unbounded number of requests from a single client. Each request invokes bcrypt password verification, which is computationally expensive by design. Attackers can leverage this behavior for credential stuffing, password spraying, and CPU-based denial of service. No CAPTCHA challenge, account lockout, or per-IP throttle interrupts the attack sequence.

Root Cause

The vulnerability stems from a framework upgrade mismatch. Laravel 11+ bootstraps middleware through bootstrap/app.php rather than the legacy App\Http\Kernel class. Plainpad retained the older Kernel.php scaffolding, causing the api throttle middleware group to become orphaned. The route-level throttle referenced in the code never attaches to the sessions route.

Attack Vector

An unauthenticated attacker sends repeated HTTP POST requests to /v1/sessions with varying credential pairs. Because no rate limiter is bound to the route, the server processes every request through the bcrypt comparison path. This enables both credential brute force and sustained CPU exhaustion against the target instance.

// Patch: removal of the unused legacy Kernel class in
// server/app/Http/Kernel.php
-<?php
-
-namespace App\Http;
-
-use Illuminate\Foundation\Http\Kernel as HttpKernel;
-
-class Kernel extends HttpKernel
-{
-    protected $middleware = [
-        \App\Http\Middleware\TrustProxies::class,
-        \Fruitcake\Cors\HandleCors::class,
-        \App\Http\Middleware\PreventRequestsDuringMaintenance::class,
-        \Illuminate\Foundation\Http\Middleware\ValidatePostSize::class,
-        \App\Http\Middleware\TrimStrings::class,
-        \Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull::class,
-    ];

Source: GitHub Commit d3823fc

The accompanying update to server/app/Providers/RouteServiceProvider.php binds a proper rate limiter to the login route using Laravel's RateLimiter facade.

Detection Methods for CVE-2026-73529

Indicators of Compromise

• High volume of POST /v1/sessions requests from a single source IP address or subnet within a short time window.
• Elevated bcrypt-related CPU utilization on the Plainpad application server without corresponding legitimate user activity.
• Repeated HTTP 401 responses returned by the /v1/sessions endpoint in web server access logs.

Detection Strategies

• Aggregate web server access logs and alert when POST /v1/sessions exceeds a baseline threshold per source over a rolling interval.
• Correlate failed authentication events with source IP reputation to identify credential stuffing patterns.
• Deploy a reverse proxy or web application firewall rule that counts requests to the login endpoint and flags anomalies.

Monitoring Recommendations

• Track authentication failure counts per account and per source IP with dashboards and alerting.
• Monitor server CPU utilization and correlate spikes with request rates to the sessions endpoint.
• Retain HTTP access logs and application authentication logs for at least 90 days to support investigation.

How to Mitigate CVE-2026-73529

Immediate Actions Required

• Upgrade Plainpad to a build that includes commit d3823fc or later.
• Place the Plainpad API behind a reverse proxy or WAF that enforces rate limiting on /v1/sessions.
• Rotate credentials for any account showing repeated failed login attempts in historical logs.

Patch Information

The fix is contained in commit d3823fc595b5d8f842a6fd7dfe49b7852a10fdac. It removes the unused legacy App\Http\Kernel class and registers a RateLimiter binding in RouteServiceProvider.php that throttles requests to the login route. See the VulnCheck Advisory on Plainpad and the GitHub Commit d3823fc for details.

Workarounds

• Configure Nginx or another upstream proxy to apply a limit_req zone against the /v1/sessions path.
• Deploy a WAF rule that blocks or challenges clients exceeding a defined request rate to the login endpoint.
• Restrict network access to the Plainpad API using IP allow lists where feasible.

# Nginx rate limit example for the login endpoint
http {
    limit_req_zone $binary_remote_addr zone=plainpad_login:10m rate=5r/m;

    server {
        location /v1/sessions {
            limit_req zone=plainpad_login burst=5 nodelay;
            proxy_pass http://plainpad_backend;
        }
    }
}