CVE-2022-2651

CRITICAL

bookwyrm-social/bookwyrm <0.4.5 - Auth Bypass

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2022-2651. PoCs published by Akshay Ravi.

AI-analyzed exploit summary This exploit describes an authentication bypass vulnerability in Bookwyrm v0.4.3 due to lack of rate-limiting on the email confirmation OTP endpoint, allowing brute-force attacks to takeover accounts.

Description

Authentication Bypass by Primary Weakness in GitHub repository bookwyrm-social/bookwyrm prior to 0.4.5.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Akshay Ravi · textwebappsmultiple
https://www.exploit-db.com/exploits/51013

This exploit describes an authentication bypass vulnerability in Bookwyrm v0.4.3 due to lack of rate-limiting on the email confirmation OTP endpoint, allowing brute-force attacks to takeover accounts.

Classification
Writeup 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: Bookwyrm <= v0.4.3
No auth needed
Prerequisites: access to the email confirmation endpoint · victim's email address
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit, Patch, Third Party Advisory x_refsource_confirm
https://huntr.dev/bounties/428eee94-f1a0-45d0-9e25-318641115550
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/168423/Bookwyrm-0.4.3-Authentication-Bypass.html

Scores

CVSS v3 9.8
EPSS 0.1138
EPSS Percentile 95.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-305
Status published
Products (1)
joinbookwyrm/bookwyrm < 0.4.5
Published Aug 04, 2022
Tracked Since Feb 18, 2026