CVE-2026-19297 Insufficient Authentication Brute Force Protection on Login Endpoint
Remote attackers can brute force login attempts to gain unauthorized access to user accounts due to missing rate limiting.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-19297?
CVE-2026-19297 is a critical authentication bypass vulnerability in Langflow Langflow, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive authentication attempts.
Weakness: CWE-307
Which versions are affected by CVE-2026-19297?
It affects 1 product.
Products include Langflow Langflow.
How do I fix CVE-2026-19297?
No fix has been published for CVE-2026-19297 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-19297 being exploited?
There is no known exploitation of CVE-2026-19297 in the wild and no public exploit code.
Other vulnerabilities in Langflow Langflow
Sources
Also known as GHSA-h6hj-8qx6-p2fm.