CVE-2026-33879 FLIP doesn't have rate limiting or brute-force protection on login
FLIP login lacks rate limiting, allowing attackers to perform brute-force and credential-stuffing attacks to compromise user accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-33879?
CVE-2026-33879 is a low-severity vulnerability in londonaicentre FLIP, published on 27 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Federated Learning and Interoperability Platform (FLIP) is an open-source platform for federated training and evaluation of medical imaging AI models across healthcare institutions. The FLIP login page in versions 0.1.1 and prior has no rate limiting or CAPTCHA, enabling brute-force and credential-stuffing attacks. FLIP users are external to the organization, increasing credential reuse risk. As of time of publication, it is unclear if a patch is available.
Weakness: CWE-307
Which versions are affected by CVE-2026-33879?
It affects 1 product.
Products include Aicentre Federated Learning and Interoperability Platform.
How do I fix CVE-2026-33879?
No fix has been published for CVE-2026-33879 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-33879 being exploited?
There is no known exploitation of CVE-2026-33879 in the wild and no public exploit code.
Sources
Also known as GHSA-p34f-488j-5cwv.