CVE-2026-105641Proof of concept (PoC) published · CISASuited to automated attack · CISA
Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass
CVSS score
9.8
EPSS probability
%0.5
Risk score
0.0
Published
10 d ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
8.1
CVE-2026-104974
Plane: Disabled User Auto-Reactivation on Login
M
Patch status unknownEPSS %1
9.8
CVE-2026-105639
Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane
M
Patch status unknownEPSS %0
9.1
CVE-2026-105640
Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)
M
Patch status unknownEPSS %0
9.1
CVE-2026-105638
Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force
M
Patch status unknownEPSS %0
9.9
CVE-2026-105636
Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)
M
Patch status unknownEPSS %0
8.1
CVE-2026-102986
Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/
M
Patch status unknownEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-105641"