← All advisories

High severity7.5NVD Advisory· Published Jan 14, 2021· Updated Jun 17, 2026

CVE-2021-3138

CVE-2021-3138

Description

In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

5

Discourse (software)/Discourse4 versions
cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*range: <=2.6.0
- cpe:2.3:a:discourse:discourse:2.7.0:beta1:*:*:*:*:*:*
- (no CPE)range: 2.7.0 through beta1
- (no CPE)
osv-coords
pkg:bitnami/discourse
Range: <= 2.6.0

Patches

Vulnerability mechanics

References

2

packetstormsecurity.com/files/162256/Discourse-2.7.0-2FA-Bypass.htmlnvdExploitThird Party AdvisoryVDB Entry
github.com/discourse/discourse/releasesnvdRelease NotesThird Party Advisory

News mentions

0

No linked articles in our index yet.