PYSEC-2026-835

    Dashboard / Vulnerabilities / PYSEC-2026-835

    PYSEC-2026-835

    Published: 7 Jul 2026Last Modified: 7 Jul 2026

    Summary: No protection against brute-force attacks on login page

    Details: ### Impact Previous versions of Kiwi TCMS do not impose rate limits which makes it easier to attempt brute-force attacks against the login page. ### Patches Users should upgrade to v12.0 or later. ### Workarounds Users may install and configure a rate-limiting proxy in front of Kiwi TCMS. For example nginx. ### References [Disclosed by spyata](https://huntr.dev/bounties/2b1a9be9-45e9-490b-8de0-26a492e79795/)

    References: https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-7968-h4m4-ghm9, https://nvd.nist.gov/vuln/detail/CVE-2023-25156, https://github.com/kiwitcms/Kiwi/commit/0ed213fa0ddb7a6dc77e3c3b99e8fc90ccdaf46f, https://github.com/kiwitcms/Kiwi, https://huntr.dev/bounties/2b1a9be9-45e9-490b-8de0-26a492e79795, https://kiwitcms.org/blog/kiwi-tcms-team/2023/02/15/kiwi-tcms-120, https://pypi.org/project/kiwitcms, https://github.com/advisories/GHSA-7968-h4m4-ghm9

    Affected packages

    Package

    Name: kiwitcms

    Purl: pkg:pypi/kiwitcms

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -12.0

    Affected versions

    10.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High