Description
CISA Thorium does not rate limit requests to send account verification email messages. A remote unauthenticated attacker can send unlimited messages to a user who is pending verification. Fixed in 1.1.1 by adding a rate limit set by default to 10 minutes.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CISA | Thorium | 1.0.0 – < 1.1.1 | 1.1.1 |
Advisories 1
- VA-25-259-01 CISA Thorium multiple vulnerabilities CISA ICS & IT advisories · Sep 16, 2025