The Plane project management tool’s magic-code login allows an attacker to submit a six‑digit numeric one‑time password (OTP) without any per‑code or per‑user attempt counter. Each incorrect submission does not trigger a lockout or invalidate the OTP session, and the view handling the verification bypasses the framework’s built‑in rate throttling. Consequently, an attacker can brute‑force the OTP by iterating through the 20‑bit space within a short time, potentially accessing the victim’s account. This weakness aligns with CWE‑307, which describes insufficient verification and controls around authentication.

The vulnerability applies to all makeplane:plane deployments using versions released prior to 1.4.0. The affected code path lives in the magic-code verifier endpoint, which any user can invoke by submitting an email address and a six‑digit OTP. The advisory specifically mentions the lack of rate limiting and the absence of a per‑code failure counter in these releases.

A CVSS score of 9.1 indicates a high‑severity vulnerability that can lead to full account compromise. While no EPSS score is published, the known lack of rate limiting makes brute‑force attacks trivially feasible. The vulnerability is not listed in the CISA KEV catalog, but the ease of exploitation and high impact suggest that it should be remediated immediately. Attackers would only need to repeatedly query the verification endpoint with different OTPs, potentially looping through all 1,000,000 possibilities in minutes, to locate a valid code and gain access.