Vulnerability · Published Mar 26, 2026 · Assigned by GitHub_M

CVE-2026-33152Tandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthentication

Critical 9.1

In plain English

A critical-severity security flaw in recipes from TandoorRecipes. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.5%top 55.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, Tandoor Recipes configures Django REST Framework with BasicAuthentication as one of the default authentication backends. The AllAuth rate limiting configuration (ACCOUNT_RATE_LIMITS: login: 5/m/ip) only applies to the HTML-based login endpoint at /accounts/login/. Any API endpoint that accepts authenticated requests can be targeted via Authorization: Basic headers with zero rate limiting, zero account lockout, and unlimited attempts. An attacker can perform high-speed password guessing against any known username. Version 2.6.0 patches the issue.

Affected products (as reported)

Vendor	Product	Versions
TandoorRecipes	recipes	< 2.6.0

Weakness: CWE-307 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-7m7c-jjqc-r522 x_refsource_CONFIRM
https://github.com/TandoorRecipes/recipes/releases/tag/2.6.0 x_refsource_MISC