The vulnerability is a rate‑limit bypass in the OTP verification flow. This allows an attacker who can trigger OTP requests to submit unlimited attempts until a correct code is found, effectively performing a brute‑force attack. Successful exploitation results in account takeover, granting the attacker full control over the victim's data. The weakness is a classic Account‑Reset‑By‑Guessing problem (CWE‑307).

This flaw exists in Outline collaborative documentation software manufactured by Outline. The affected releases are all versions from 0.86.0 through 1.5.x. The vendor released a fix in version 1.6.0.

The CVSS score of 9.1 indicates very high severity. The EPSS score is below 1 %, suggesting a low current attack probability, but the vulnerability is not listed in the CISA KEV catalog. The exploit requires only the ability to initiate an OTP for a known email address and does not require elevated privileges or additional software. Because the rate limiter could be bypassed, an attacker can carry out the attack from any location that can reach the Outline instance, making it a remote exploitation path.