CVE-2026-19256

{
  "etk_id": "ETK-2026-3591",
  "cve_id": "CVE-2026-19256",
  "display_id": "CVE-2026-19256",
  "ghsa_id": "GHSA-j2j9-q63m-9wvj",
  "euvd_id": "EUVD-2026-117334",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Insufficient login-code rate limiting in All In One Login",
  "summary": "All In One Login versions before 2.5.0 inadequately limit attempts against passwordless email login codes. An unauthenticated attacker may take over user accounts, including administrator accounts, when the affected passwordless login feature is enabled.",
  "mitigation": "Update All In One Login to version 2.5.0 or later. Prioritize updates on sites where passwordless email login is enabled.",
  "vendor": null,
  "product": "All In One Login",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.4.0, < 2.5.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.5.0"
      ],
      "package_name": "All In One Login",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 14.977062466666666,
  "t0_at": "2026-11-05T06:00:23.724000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-05T06:39:19.522805+00:00",
      "days": 0.027034708391203702,
      "is_lower_bound": false,
      "measured_at": "2026-11-05T06:00:23.724000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-05T06:00:23.724000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-05T06:00:23.724000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19256"
    }
  }
}