Description
SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because verifyUser() is never called. Attackers can repeatedly POST to /api/notify, optionally with a domain parameter, to exhaust SMTP rate limits, trigger provider abuse flags and flood recipients.
Published: 2026-10-30
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized Email Notifications
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a missing authentication check in the /api/notify handler of SerpBear. Attackers can send unauthenticated POST requests to trigger notification emails, potentially flooding recipients, exceeding SMTP limits, and causing abuse flags. Since the issue is an authentication bypass (CWE-306), any user can exploit it without credentials to abuse the email sending functionality.

Affected Systems

SerpBear versions prior to 3.1.1, specifically 3.1.0 and earlier, built by towfiqi.

Risk and Exploitability

The CVSS score is 6.9, indicating a moderate severity. The EPSS score is not provided, so the probability of exploitation is unknown, but the vulnerability can be exploited from any network via an unauthenticated HTTP POST to /api/notify. It is not currently listed in the CISA KEV catalog. Attackers can repeatedly flood the notification endpoint, causing abuse flags and potential denial of service to legitimate email recipients.

Generated by OpenCVE AI on October 30, 2026 at 16:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade SerpBear to version 3.1.1 or later
  • If an upgrade is not immediately possible, restrict access to the /api/notify endpoint through a network or application firewall so that only trusted hosts can POST
  • Monitor SMTP logs for abnormal activity and adjust rate limits to mitigate potential abuse

Generated by OpenCVE AI on October 30, 2026 at 16:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because verifyUser() is never called. Attackers can repeatedly POST to /api/notify, optionally with a domain parameter, to exhaust SMTP rate limits, trigger provider abuse flags and flood recipients.
Title SerpBear before 3.1.1 Missing Authentication via POST /api/notify
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-30T18:36:44.022Z

Reserved: 2026-10-30T14:49:22.998Z

Link: CVE-2026-119705

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-30T16:17:51.483

Modified: 2026-10-30T16:17:51.483

Link: CVE-2026-119705

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T16:45:15Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function