CVE-2026-127079

EUVD-2026-125103
OpsTree BuildPiper before 2.7.0 lacks rate limiting on password-reset OTP verification, allowing unauthenticated attackers to brute force 6-digit OTPs. Attackers can initiate a reset and submit unthrottled guesses to the check_otp endpoint, resetting the target's password and taking over the account.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.4 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 37.76%
Common Weakness Enumeration
References
https://gist.github.com/neelkotnis/c3c9d02c324a73937ca4db81f223435e
https://www.buildpiper.io/
https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-otp-brute-force-via-password-reset-check-otp