UpHeron
All vulnerabilities

Servers and applications

CVE-2021-3138

In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms.

Severity
High 7.5
Published
14 Jan 2021
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
DiscourseServers and applications · cpe:a:discourse:discourse
  • Every version up to 2.6.0
  • Version 2.7.0-beta1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-3138
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-3138