Vulnerability GHSA-5549-c5q7-fj65
Low Risk
LOW RISK
CVSS Score: 3.0
Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
5 months ago
June 05, 2026 at 03:21 PM UTC
Vantage6: No limit on emails sent for password/MFA reset
0.0.0b0 - 5.0.0rc91
0.0.0b0 - 5.0.0rc91
Summary
Vantage6: No limit on emails sent for password/MFA reset
Details
Impact
Users can reset their MFA token via API routes that send them an email. Currently the number of emails that is sent is not limited. This gives attackers the option to flood someones mailbox with a lot of emails, and would have adverse effects on the SMTP server which may be seen as spam sender.
Note resetting the MFA token requires a correct password, so the potential impact for this is very low.
Patches
No
Workarounds
No
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
2 months ago
vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review
0.0.0b0 - 5.0.2 PYSEC-2026-3703
0.0.0b0 - 5.0.2 PYSEC-2026-3703
High Risk
3 months ago
vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review
0.0.0b0 - 5.0.2 GHSA-47w6-gwp4-w6vc
0.0.0b0 - 5.0.2 GHSA-47w6-gwp4-w6vc
Unknown
3 months ago
Vantage6: Set admin user and password from environment or configuration
0.0.0b0 - 5.0.0rc91 PYSEC-2026-3400
0.0.0b0 - 5.0.0rc91 PYSEC-2026-3400
Unknown
3 months ago
vantage6 node has an Improper Access Control issue
0.0.0b0 - 5.0.0rc91 PYSEC-2026-3401
0.0.0b0 - 5.0.0rc91 PYSEC-2026-3401
Unknown
3 months ago
Vantage6: 2FA can be circumvented with hacked email access
0.0.0b0 - 5.0.0rc91 PYSEC-2026-3398
0.0.0b0 - 5.0.0rc91 PYSEC-2026-3398
Impacted packages
Timeline
Published
5 months ago
June 05, 2026 at 03:21 PM UTC
Fixed (5.0.0)
5 months ago
June 04, 2026 at 10:51 AM UTC
Last Modified
18 hours ago
November 03, 2026 at 04:30 PM UTC