Advisory · CVE-2026-105835
Planka TOTP endpoint allows two-factor code brute force
Planka 2.2.0 through 2.2.1 does not limit incorrect TOTP codes submitted to the verify endpoint, letting an attacker who knows a user's password guess six-digit codes inside the ten-minute pending-token window and obtain a full access token.
- Vendor
- Planka
- Product
- Planka
- Identifier / CWE
- CVE-2026-105835
CWE-307 - Action timing
- Immediate
Explain it like I’m five
Planka checks your password, then asks for the six-digit code from your authenticator app. But it never stops anyone from guessing, so an attacker who already knows the password can keep typing codes until one works, and the front door swings open.
- 01Password login
The attacker logs in with a known or phished password and receives a pending token that stays valid for ten minutes.
- 02Code guessing
They submit six-digit codes to POST /api/access-tokens/verify-totp with no limit on incorrect attempts.
- 03Correct guess
The ten-minute window and the absence of lockout or throttling make brute-forcing a correct code practical.
- 04Full token issued
A correct code exchanges the pending token for a full access token, giving the attacker the victim's account.
What happened
Planka versions 2.2.0 through 2.2.1 fail to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp. After a password login, the server issues a pending token valid for ten minutes; an attacker who knows the victim’s password can reuse that token to submit unlimited guesses at the six-digit code until one succeeds, at which point a full access token is issued.
The flaw is rated critical at CVSS 4.0 9.1 and tracked as CWE-307 (improper restriction of excessive authentication attempts). An upstream fix has been committed; operators should upgrade to a release containing it.
What to do
- Upgrade Planka to a release that includes the upstream fix for the TOTP verification endpoint.
- If immediate upgrade is not possible, put the instance behind a web application firewall or reverse proxy that rate-limits the verify-totp endpoint.
- Enforce strong, unique passwords and consider rotating credentials for accounts that may have been targeted.
- Review authentication logs for bursts of verify-totp attempts or successful logins following many failures.
- Confirm two-factor verification attempts are now throttled after the update.
Management note
This turns a single stolen password into a full account takeover by defeating the second factor. Any self-hosted Planka instance reachable on the network should be treated as exposed until patched, and login logs reviewed for brute-force patterns.