CodeBleed
| CVE | Icon | Vulnerability name | Date | Responsible Security Disclosure by | Stars | Process | Vulnerabilities |
|---|---|---|---|---|---|---|---|
| - | CodeBleed | 2026-10-02 | xet7 |  |
Found while auditing passwordless sign-in after the 2026-10-02 Hall of Fame review; fixed by xet7. | Passwordless sign-in codes were Meteor's default: six hexadecimal characters, valid for an hour. The login lockout counts wrong passwords, not wrong codes, and the only limit was per connection, which an attacker multiplies by opening connections. With about a thousand connections, a code could be guessed with about one chance in ten within its hour - for any account, administrators included, wherever passwordless sign-in is enabled. Codes are now ten hexadecimal characters, over a trillion values, valid for 15 minutes: the same spray has about one chance in three million. The code field accepts the whole code and no longer opens a numeric keyboard. CWE-307, CWE-330. High severity where passwordless sign-in is enabled. No CVE assigned. Fix prepared locally for the Upcoming release; not yet released. |
Details
WeKan used accounts-passwordless with Meteor's default token: six hexadecimal characters, about 16.7 million values, valid for one hour. The login lockout counts wrong passwords and does not see wrong codes, and the rate limit on the code method is per connection, so an attacker who opens many connections multiplies it.
Requesting a code for an account needs only its email address. With about a thousand connections the hour's guesses covered roughly a tenth of the code space, so each requested code had about one chance in ten of being found - for any account, administrators included.
Fix
Codes are ten hexadecimal characters - over a trillion values - and expire after 15 minutes, which brings the same spray to about one chance in three million. The sign-in form's code field no longer asks for a numeric keyboard and accepts the whole code, letters included.
Detection
None. A wrong code cannot be told apart from a mistyped one, so a refusal is not an attempt to record in Admin Panel → Problems; the fix is the code's entropy and lifetime.
Verification
Unit tests in tests/codeBleed.test.cjs compute that a code is long and short-lived enough that spraying it is hopeless, check that the code field accepts the whole code, and the negative test fails if anything configures a shorter or longer-lived code. The unit tests pass in the WeKan repository. There is no browser test.