CVE-2026-105127 LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints
Unauthenticated attackers can exhaust API quotas via password recovery endpoints, causing validation failures and potential security bypasses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-105127?
CVE-2026-105127 is a medium-severity denial of service vulnerability in laradashboard, published on 3 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making validation fail open for all public forms, and probe domain resolution.
Weakness: CWE-770
Which versions are affected by CVE-2026-105127?
How do I fix CVE-2026-105127?
No fix has been published for CVE-2026-105127 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-105127 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-105127 exists.
Sources
Also known as GHSA-g2mx-6phx-6vgr.