{"dataType":"CVE_RECORD","dataVersion":"1.0","cveMetadata":{"cveId":"GCVE-110-VULN-PYPI-2026-000644","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-10-27T22:42:51Z","dateUpdated":"2026-10-27T22:55:07Z","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"en","value":"If the skopos-fleet 0.2.1 dashboard login is reachable by people who should not operate it, any of them can keep you from signing in. Every failed login also counts against a budget shared by all addresses (auth_store.register_failed_login), and 30 failures within 15 minutes (SKOPOS_LOGIN_GLOBAL_MAX_ATTEMPTS) lock the login for every address for SKOPOS_LOGIN_LOCKOUT_SECONDS (300 by default). Sending 30 wrong passwords every five minutes keeps the login closed, including during an incident the dashboard is meant to help with. A browser that is already signed in and holds a valid session cookie is let in without the login form, so only new sign-ins are refused. The shared budget was added in 0.2.1 to bound password guessing (GCVE-110-PYPI-2026-021896). Affects 0.2.1.","supportingMedia":null}],"references":[{"url":"https://pypi.org/project/skopos-fleet/","name":"","tags":["advisory"]}],"metrics":[{"format":"","scenarios":null,"cvssV2_0":null,"cvssV3_0":null,"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM"},"cvssV4_0":null,"other":null}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Overly Restrictive Account Lockout Mechanism","cweId":"CWE-645","type":"CWE"}]}],"affected":[{"vendor":"pypi","product":"skopos-fleet","collectionURL":"https://pypi.org","packageName":"skopos-fleet","repo":"","defaultStatus":"unknown","versions":[{"version":"0.2.1","status":"affected","versionType":"python","lessThan":"","lessThanOrEqual":"","changes":null}],"cpes":null,"modules":["skopos.auth_store"],"programFiles":["skopos/auth_store.py"],"programRoutines":[{"name":"skopos.auth_store.register_failed_login"},{"name":"skopos.auth_store.login_lockout_remaining_seconds"}],"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null},"adp":null}}