The vulnerability resides in Tandoor Recipes’ use of Django REST Framework with BasicAuthentication as a default backend. Because the built‑in account rate limiting only protects the web login page, API endpoints that accept BasicAuthentication headers are left unguarded. An attacker can therefore brute‑force any known username at an unrestricted rate, achieving unauthorized access. This weakness is cataloged as CWE‑307, a flaw that permits password brute‑forcing.

The affected product is Tandoor Recipes (recipe‑management application). All releases before version 2.6.0 are impacted; the 2.6.0 release includes the fix.

The CVSS score of 9.1 marks the issue as critical. Although the EPSS score is below 1%, indicating a low probability of public exploitation, the existing high severity and absence of rate limiting mean that organizations with Tandoor Recipes can be targeted by automated tools or attackers with minimal effort. The vulnerability has not yet been listed in the CISA KEV catalog, but because it permits unrestricted credential guessing via existing API endpoints, it remains a high‑risk concern for any environment that relies on this system for user authentication.