Exploit discussion active in current signal (4 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, Tandoor Recipes configures Django REST Framework with BasicAuthentication as one of the default authentication backends. The AllAuth rate limiting configuration (ACCOUNT_RATE_LIMITS: login: 5/m/ip) only applies to the HTML-based login endpoint at /accounts/login/. Any API endpoint that accepts authenticated requests can be targeted via Authorization: Basic headers with zero rate limiting, zero account lockout, and unlimited attempts. An attacker can perform high-speed password guessing against any known username. Version 2.6.0 patches the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-33152 Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, Tandoor Recipes configures Django RES… https://www.cve.org/CVERecord?id=CVE-2026-33152
Post summary
A brief disclosure of CVE-2026-33152 focusing on affected versions and Django configuration, without details on exploitation or remediation.
🔴 CVE-2026-33152 - Critical Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, Tandoor Recipes configures Django REST Framework with Basi... https://www.thehackerwire.com/vulnerability/CVE-2026-33152/ https://t.co/74AT1hMtaa
Post summary
The post announces a critical vulnerability (CVE-2026-33152) affecting Tandoor Recipes prior to version 2.6.0, but provides no PoC, exploit code, active exploitation evidence, patch information, or detailed technical specifics.
[CVE-2026-33152: CRITICAL] Prior to version 2.6.0, Tandoor Recipes had a severe security flaw where BasicAuthentication lacked rate limiting in API endpoints, exposing it to brute force attacks. Update to 2....#cve,CVE-2026-33152,#cybersecurity https://cvefind.com/CVE-2026-33152
Post summary
The post highlights a CVE affecting Tandoor Recipes that lacks rate limiting in BasicAuthentication, but it indicates that upgrading to version 2.6.0 or later resolves the issue.
🚨 CVE-2026-33152: Tandoor Recipes Vulnerable to Un... Basic auth bypass on recipe app = unlimited password spraying against any API endpoint while HTML login gets rate limit... https://zerodaysignal.com/vulnerability/CVE-2026-33152 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
A Proof of Concept for CVE-2026-33152 is shared via an external link, indicating an authentication bypass that allows unlimited password spraying, though no active exploitation or patch information is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | tandoor | recipes | - | - | - |