CVE-2026-33152
Tandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthentication
In short
Tandoor Recipes allows attackers to guess user passwords unlimited times through its API without any restrictions or delays. This bypasses the normal login protections and lets hackers quickly break into accounts.
Technical detail
The application exposes API endpoints with BasicAuthentication without rate limiting or account lockout mechanisms, while rate limiting is only enforced on the HTML login form. An attacker can perform rapid brute-force attacks against known usernames via Authorization headers with no throttling, leading to credential compromise.
Summary generated and translated by AI from the official description.
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, Tandoor Recipes configures Django REST Framework with BasicAuthentication as one of the default authentication backends. The AllAuth rate limiting configuration (ACCOUNT_RATE_LIMITS: login: 5/m/ip) only applies to the HTML-based login endpoint at /accounts/login/. Any API endpoint that accepts authenticated requests can be targeted via Authorization: Basic headers with zero rate limiting, zero account lockout, and unlimited attempts. An attacker can perform high-speed password guessing against any known username. Version 2.6.0 patches the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
TandoorRecipes · recipesWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →