CVE-2026-33640: 
NixOS vulnerability analysis and mitigation

CVE-2026-33640 is a rate limit bypass vulnerability in Outline, a collaborative documentation platform, that allows unauthenticated attackers to brute force Email OTP login codes and achieve full account takeover. The flaw affects Outline versions 0.86.0 through 1.5.x (prior to 1.6.0) and was disclosed on March 26, 2026, with the security advisory published by maintainer tommoor on March 23, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.1 (Critical) (GitHub Advisory).

The root cause is classified as CWE-307 (Improper Restriction of Excessive Authentication Attempts). Outline's /auth/email.callback endpoint, which validates Email OTP codes, does not invalidate codes after a threshold of failed attempts, does not enforce account lockout, and relies solely on an opt-in rate limiter for protection. Two distinct rate limiter bypass techniques were identified: (1) JWT Forging — the rate limiter derives its key from the id claim of a JWT cookie, but the JWT is only decoded (not verified), allowing an attacker to forge JWTs with arbitrary UUIDs to continuously reset their rate limit window; (2) X-Forwarded-For Spoofing — on misconfigured deployments without a properly configured reverse proxy, the rate limiter falls back to IP-based limiting, which can be bypassed by supplying arbitrary values in the X-Forwarded-For header. OTP codes occupy a keyspace of 900,000 values (100000–999999) with a 10-minute lifetime, making brute force statistically viable (GitHub Advisory).

Successful exploitation enables complete account takeover of any Outline user who authenticates via Email OTP (i.e., users not associated with an Identity Provider). An attacker with knowledge of a target's email address can gain unauthorized access to that user's workspace, including all documents, collaborative content, and sensitive organizational knowledge stored within Outline. The confidentiality and integrity of all data accessible to the compromised account are at risk, and in multi-workspace cloud deployments, the attacker can exchange a transfer token for a full session token (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, including a concrete ffuf-based brute force command targeting the /auth/email.callback endpoint. The advisory was assessed with high confidence as a real exploit by Feedly threat intelligence. There is no current evidence of in-the-wild exploitation, and the CVE is not listed in the CISA KEV catalog. The EPSS score is approximately 0.041% (0.000410), reflecting low but non-zero exploitation probability at time of publication (GitHub Advisory).

1. Reconnaissance: Identify the target Outline instance (self-hosted or cloud) and obtain the victim user's email address. Confirm the instance uses Email OTP login (i.e., the user is not linked to an SSO/Identity Provider).
2. Generate OTP wordlist: Create a list of all valid 6-digit OTP codes (100000–999999) using a shell loop:

   for i in {100000..999999}; do echo $i; done > pins.txt

3. Trigger OTP generation: Send a POST request to /auth/email with the victim's email address to cause Outline to generate and email an OTP code to the target, starting the 10-minute validity window.
4. Bypass rate limiter (if enabled):
   • JWT Forging: Forge a JWT cookie with an arbitrary id (UUID) claim (no signature verification required) and rotate it with each batch of requests to reset the rate limit key.
   • X-Forwarded-For Spoofing: On misconfigured deployments, rotate the X-Forwarded-For header value with each request to bypass IP-based rate limiting.
5. Brute force OTP: Submit all possible OTP codes to /auth/email.callback using ffuf:

   ffuf -mode pitchfork -w ./pins.txt:PIN -X POST \
     -u https://<target>/auth/email.callback \
     -H "Content-Type: application/json" \
     -d '{"email":"victim@user.com", "code":"PIN", "follow":"true"}' \
     -mc 302 -v -fr "invalid-code"

6. Capture session token: A successful match returns an HTTP 302 redirect with a valid JWT (self-hosted) or a transfer token (cloud multi-workspace). Exchange the transfer token for a session token if needed.
7. Account takeover: Use the obtained session token to authenticate as the victim and access their Outline workspace and documents (GitHub Advisory).

• Network: High-volume POST requests to /auth/email.callback from a single IP or rotating IPs within a short time window; requests with varying or spoofed X-Forwarded-For header values targeting the same endpoint; requests with rotating JWT cookies containing different id (UUID) claim values.
• Logs: Outline application logs showing hundreds or thousands of failed OTP submission attempts for a single email address within a 10-minute period; log entries for /auth/email.callback with sequential or near-sequential OTP code values; a single successful 302 redirect response following a large number of 4xx responses for the same email.
• Authentication Events: Unexpected successful login events for a user account via Email OTP, especially from an unfamiliar IP address or geographic location; OTP generation requests (/auth/email) followed immediately by a high volume of callback attempts.
• File System / Process: No specific file system or process artifacts expected, as this is a network-based authentication attack with no code execution component (GitHub Advisory).

Upgrade Outline to version 1.6.0 or later, which adds a hard limit of 10 OTP submission attempts per code (PR #11623) and improves the rate limiter to use a combination of user ID and IP address (PR #11613) (Outline v1.6.0 Release). If immediate patching is not possible, ensure RATE_LIMITER_ENABLED=true is set in the .env configuration and that a properly configured reverse proxy is in place to prevent X-Forwarded-For spoofing. Additionally, consider restricting access to the Outline instance to trusted networks and monitoring for anomalous OTP submission patterns as a temporary defensive measure (GitHub Advisory).

The vulnerability was reported by security researcher themisp20 and disclosed responsibly through GitHub's security advisory process. The advisory was noted on Bluesky via the CVE tracking account shortly after publication. Coverage appeared on security aggregator sites including infinitsec.net, cvefeed.io, and VulDB. No major vendor statements beyond the Outline maintainer's advisory and patch release have been identified (GitHub Advisory).