CRITICAL🇵🇱 Wersja polska

CVE-2026-33152

CVSS 9.1v3.1pub. 2026-03-26upd. 2026-03-30

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, Tandoor Recipes configures Django REST Framework with BasicAuthentication as one of the default authentication backends. The AllAuth rate limiting configuration (ACCOUNT_RATE_LIMITS: login: 5/m/ip) only applies to the HTML-based login endpoint at /accounts/login/. Any API endpoint that accepts authenticated requests can be targeted via Authorization: Basic headers with zero rate limiting, zero account lockout, and unlimited attempts. An attacker can perform high-speed password guessing against any known username. Version 2.6.0 patches the issue.

🤖 AI Analysis
How it works

The application uses Django REST Framework configured with BasicAuthentication as one of the default authentication backends. The AllAuth rate limiting mechanism (5 attempts per minute per IP address) works only for the HTML endpoint /accounts/login/ and does not cover API endpoints. An attacker can therefore direct HTTP requests with the Authorization: Basic header to any protected API endpoint, performing an unlimited number of password guessing attempts without risk of account lockout or slowdown.

Impact

An attacker knowing a username can conduct a rapid brute-force attack and take control of an account, gaining full access to data (C:H) and the ability to modify resources (I:H) without any server-side restrictions.

Mitigation & patch

Tandoor Recipes should be updated to version 2.6.0, which contains a fix eliminating the vulnerability. Details are available in the manufacturer's references on GitHub.

Who is affected

Tandoor Recipes in versions earlier than 2.6.0

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
  • Tandoor Recipes

    APP
    Tandoor
    < 2.6.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-23211CRITICAL9.9PL ✓same product

Tandoor Recipes: SSTI w Jinja2 umożliwia RCE każdemu zalogowanemu użytkownikowi

CVE-2026-35489HIGH7.3same product

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to ...

CVE-2026-35488HIGH8.1same product

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to ...

CVE-2026-35045HIGH8.1same product

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to ...

CVE-2026-33153HIGH7.7same product

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versio...