Description
A flaw has been found in OpenCATS 0.10.0. Affected is the function processLogin of the file modules/careers/CareersUI.php of the component Career Portal. This manipulation of the argument applyToJobSubAction causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been published and may be used. Patch name: 1cf4fa3ee9054314b023be79d404078645c22ade. It is suggested to install a patch to address this issue. The project maintainer explains: "Candidates will now need to authenticate each time they access the Career Portal and successfully complete the CAPTCHA as part of that authentication flow. The authenticated candidate identity is now maintained server-side rather than relying on the previous persistent client-side cats…cw cookie mechanism. Application-level rate limiting is deliberately not in scope for this change. In my view, request throttling and brute-force protection of that kind are better applied at the network, reverse-proxy or web-server layer, where they can be configured appropriately for each deployment without OpenCATS having to implement and maintain its own rate-limiting framework. I'll update the online documentation to that effect."
Published: 2026-10-18
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Authentication Bypass / Brute‑Force
Action: Apply Patch
AI Analysis

Impact

OpenCATS version 0.10.0 contains a flaw in the processLogin function of module CareersUI.php. Manipulating the applyToJobSubAction argument disables the intended restriction on excessive authentication attempts, permitting an attacker to submit an unlimited number of login requests. The vulnerability can be triggered remotely, although it requires significant effort to do so, resulting in a CVSS score of 6.3.

Affected Systems

The affected system is the OpenCATS application, specifically version 0.10.0. The flaw resides in modules/careers/CareersUI.php of the Career Portal component. No other product versions are listed as impacted by the CNA data.

Risk and Exploitability

Because the flaw allows remote exploitation, an attacker could perform brute‑force authentication attempts against the Career Portal. The EPSS score is not available, and the vulnerability is not included in the CISA KEV catalog. The CVSS score indicates a moderate severity. The exploitability is described as difficult, but a public patch exists. Without mitigation, repeated authentication attempts could lead to account compromise or denial of service by exhausting user resources.

Generated by OpenCVE AI on October 18, 2026 at 06:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor patch identified by commit 1cf4fa3ee9054314b023be79d404078645c22ade
  • Configure network‑level or reverse‑proxy rate limiting to throttle repeated login requests and prevent brute‑force attacks
  • Ensure that each login request requires CAPTCHA completion and that the server maintains authenticated session state server‑side, not client‑side cookies

Generated by OpenCVE AI on October 18, 2026 at 06:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 05:30:00 +0000

Type Values Removed Values Added
Description A flaw has been found in OpenCATS 0.10.0. Affected is the function processLogin of the file modules/careers/CareersUI.php of the component Career Portal. This manipulation of the argument applyToJobSubAction causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been published and may be used. Patch name: 1cf4fa3ee9054314b023be79d404078645c22ade. It is suggested to install a patch to address this issue. The project maintainer explains: "Candidates will now need to authenticate each time they access the Career Portal and successfully complete the CAPTCHA as part of that authentication flow. The authenticated candidate identity is now maintained server-side rather than relying on the previous persistent client-side cats…cw cookie mechanism. Application-level rate limiting is deliberately not in scope for this change. In my view, request throttling and brute-force protection of that kind are better applied at the network, reverse-proxy or web-server layer, where they can be configured appropriately for each deployment without OpenCATS having to implement and maintain its own rate-limiting framework. I'll update the online documentation to that effect."
Title OpenCATS Career Portal CareersUI.php processLogin excessive authentication
First Time appeared Opencats
Opencats opencats
Weaknesses CWE-307
CWE-799
CPEs cpe:2.3:a:opencats:opencats:*:*:*:*:*:*:*:*
Vendors & Products Opencats
Opencats opencats
References
Metrics cvssV2_0

{'score': 2.6, 'vector': 'AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 3.7, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Opencats Opencats
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-18T05:15:11.452Z

Reserved: 2026-10-17T09:39:40.097Z

Link: CVE-2026-111874

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-18T06:16:56.380

Modified: 2026-10-18T06:16:56.767

Link: CVE-2026-111874

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T06:30:17Z

Weaknesses
  • CWE-307

    Improper Restriction of Excessive Authentication Attempts

  • CWE-799

    Improper Control of Interaction Frequency