NVD HIGH: CVE-2026-105835 — PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST...

Tuesday, October 6, 2026 at 01:16 PM UTC·Source: NIST NVD

Updated: Tuesday, October 6, 2026 at 06:00 PM UTC

Executive Summary

PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one succeeds, obtaining a full access token.

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-105835

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Oct 6, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Ledger confirms spy chip implant behind wallet crypto thefts

Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets. [...]

1h agoBleepingComputer

MEDIUMVulnerability

Cyberattack shuts down refrigerators at French supermarkets

Attackers remotely defrosted refrigerators at multiple French supermarket chains overnight in a cyberattack that reportedly targeted Danfoss refrigeration controllers. [...]

2h agoBleepingComputer

CRITICALVulnerability

NVD CRITICAL: CVE-2026-108896 — A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the functio...

A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument _6rd_prefix/_6rd_prefix_len results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-108896

2h agoNIST NVD