Plainpad through version 1.1.1 contains a missing rate‑limiting check on the POST /v1/sessions endpoint. An unauthenticated attacker can send an unlimited number of login requests because a dead code block that should enforce throttling is never executed in the Laravel 11+ skeleton. This allows credential guessing and, due to bcrypt password hashing, can also saturate CPU resources, potentially causing denial of service. The vulnerability is classified as CWE‑307.

The affected product is Plainpad from alextselegidis, version 1.1.1 and any earlier releases that use the Laravel 11+ skeleton. The fix was applied in commit d3823fc. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

The CVSS score is 6.9, indicating a medium severity. EPSS data is not available, so the current exploitation probability cannot be quantified, but the lack of rate limiting makes exploitation straightforward for an attacker with network access. The vulnerability is not present in KEV, suggesting no widespread exploitation reports yet, but the impact remains significant for exposed installations. Attackers would use simple automated scripts to flood the endpoint and can also trigger CPU exhaustion by repeatedly invoking bcrypt on each request.