CVE-2025-35432
CISA Thorium does not rate limit account verification email messages
Summary
CISA Thorium does not rate limit account verification email messages
Original description
The description as published by the source.
CISA Thorium does not rate limit requests to send account verification email messages. A remote unauthenticated attacker can send unlimited messages to a user who is pending verification. Fixed in 1.1.1 by adding a rate limit set by default to 10 minutes.
References
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com
- web raw.githubusercontent.com
- web cve.org