GitHub Advisoryadvisory · PyPI

GHSA-5549-c5q7-fj65 Vantage6: No limit on emails sent for password/MFA reset

LOW Published 2026-06-05 Modified 2026-11-03 Official page ↗
Aliases
CVE-2024-24769
Ecosystem
PyPI
Packages
vantage6
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-400
Reviewed
2026-06-05

Affected packages

• PyPI vantage6: < 5.0.0 → fixed in 5.0.0

Description

Impact Users can reset their MFA token via API routes that send them an email. Currently the number of emails that is sent is not limited. This gives attackers the option to flood someones mailbox with a lot of emails, and would have adverse effects on the SMTP server which may be seen as spam sender. Note resetting the MFA token requires a correct password, so the potential impact for this is very low. Patches No Workarounds No

Related

Alias · CVE (1)

  • CVE-2024-24769 vantage6 is an open-source infrastructure for privacy preserving analysis. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References