| Package | Affected versions | Patched versions |
|---|---|---|
| No affected product versions are listed for this vulnerability yet. | ||
SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because verifyUser() is never called. Attackers can repeatedly POST to /api/notify, optionally with a domain parameter, to exhaust SMTP rate limits, trigger provider abuse flags and flood recipients.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free