The vulnerability allows an attacker who knows a user’s password to repeatedly probe a verification endpoint for the six‑digit one‑time password. Because the endpoint does not enforce any limit on incorrect attempts, an attacker can brute‑force the TOTP within the ten‑minute window of the pending token and obtain a full access token. This effectively bypasses two‑factor authentication and grants the attacker full privileges for the affected user.

Versions 2.2.0 and 2.2.1 of Planka, a project management tool distributed under the planka:planka vendor label. The vulnerability is present in the verify‑totp API controller, which is part of the server side implementation of the application. No other product versions were explicitly noted.

With a CVSS score of 9.1 the flaw is classified as critical. The absence of an EPSS value indicates that no exploitation probability data is available, but the flaw’s nature makes it highly attractive to attackers. Because the CVE is not listed in the CISA KEV catalog, there is no known active exploitation, yet the underlying weakness (CWE-307) is a common vector for credential theft. Attackers could exploit the endpoint over the network if the application is exposed, so the attack vector is likely remote.