AIKIDO-2026-446701
apostrophe is vulnerable to Improper Restriction of Excessive Authentication Attempts
59
Medium Risk
This Affects:
apostropheTL;DR
The authenticated password-change endpoint, which requires submitting the user's current password, applies no attempt-throttling or lockout to repeated submissions. An authenticated attacker can issue unlimited guesses against the current-password field to brute-force a user's existing password. The patch adds attempt throttling to the password-change endpoint.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
apostrophe is vulnerable to Improper Restriction of Excessive Authentication Attempts in versions 0.0.1 - 4.32.2.
How to fix this
Upgrade the apostrophe library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.