Description
OpsTree BuildPiper before 2.7.0 lacks rate limiting on password-reset OTP verification, allowing unauthenticated attackers to brute force 6-digit OTPs. Attackers can initiate a reset and submit unthrottled guesses to the check_otp endpoint, resetting the target's password and taking over the account.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpsTree Solutions | BuildPiper | 0 <2.7.0 | — |