Outline’s email OTP login flow, which is used for users not linked to an Identity Provider, lacks proper invalidation of OTP codes after too many failed attempts. The application relies on a rate limiter to deter brute force, but a bypass in this limiter allows attackers to submit unlimited OTP attempts within the code’s lifetime. This flaw enables attackers to guess the short OTP code, achieving unauthorized access to a user’s account and compromising the system’s confidentiality and integrity.

The affected product is Outline by Outline. The vulnerability is present in releases starting with version 0.86.0 and continuing through all versions prior to 1.6.0. Any deployment of Outline within that version range is susceptible to OTP brute‑force attacks.

The vulnerability carries a CVSS score of 9.1, indicating a high severity impact. EPSS data is not available, and the issue has not been listed in CISA’s KEV catalog. The likely attack vector is a brute‑force attempt that exploits the rate‑limit bypass, requiring only knowledge of the user’s email address and the OTP code during its validity period. Because of the unrestricted attempts, the likelihood of successful exploitation is significant in environments where Outline is accessible over the internet.