Description

A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been made public and could be used. Upgrading to version 0.33.0 is sufficient to fix this issue. The patch is identified as f7d042971d0d2bcc7119654830cf1eb93eabbf24. It is advisable to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-18T11:16:52.200Z",
  "pubdate": "2026-08-18T11:16:52.200Z",
  "executiveSummary": "A vulnerability has been identified in the karakeep-app karakeep product affecting versions up to 0.32.0. The security flaw involves an improper restriction of excessive authentication attempts, falling under the domain of brute-force and credential stuffing vulnerabilities. The affected component is the login endpoint implemented within the authorize function located in apps/web/server/auth.ts.\nThe risk implications include potential unauthorized access to user accounts through automated enumeration and credential guessing attacks. Remote attackers can execute this attack vector over the network without requiring prior authentication or elevated privileges. However, the attack is characterized by high complexity and difficult exploitability, requiring specific conditions or coordination to successfully abuse the missing rate-limiting mechanism.\nDespite the high complexity and difficult exploitability metrics, the public availability of an exploit elevates the overall operational risk for deployments running vulnerable versions. Organizations and administrators utilizing karakeep-app karakeep up to 0.32.0 must prioritize remediation efforts to prevent potential exploitation and secure authentication boundaries.",
  "technicalDetails": "The root cause of the vulnerability stems from the absence or improper implementation of rate-limiting controls within the authentication logic of karakeep-app karakeep. Specifically, the authorize function within apps/web/server/auth.ts fails to adequately restrict the frequency and volume of successive authentication requests originating from a remote client.\nThe affected component is the login endpoint managed by the server-side authentication module. Affected versions span all releases of karakeep-app karakeep up to and including version 0.32.0. The vulnerability is accessible over the network, allowing remote unauthenticated actors to target the authentication handler.\nThe exploitation method relies on the attacker's ability to send continuous streams of authentication requests to the target login endpoint without triggering automated lockouts, account throttling, or IP-based rate limits. Because the application processes these repeated authorize function calls without interception or delay, malicious actors can perform high-speed credential brute-forcing or automated password guessing attacks against valid user accounts.\nThe attack flow proceeds as follows: First, the remote attacker identifies the network-exposed login endpoint handling authentication routines via apps/web/server/auth.ts. Second, the attacker crafts an automated script to repeatedly invoke the authorize function using permutations of usernames and passwords. Third, because the underlying code lacks robust request throttling or progressive delays, the application processes each authentication attempt sequentially. Finally, if successful, the attacker bypasses intended logical restrictions on excessive request submission, potentially acquiring valid session credentials or unauthorized access.\nAlthough the attack is described as having high complexity and difficult exploitability, the public release of a functional exploit script lowers the barrier for malicious execution. Post-exploitation impact includes unauthorized account access, potential data exposure, and lateral movement within the application environment depending on the privileges associated with the compromised account."
}