CVE-2026-10216
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A vulnerability was detected in unitedbyai droidclaw up to 0.5.3 in the claim endpoint of server/src/routes/pairing.ts, involving improper restriction of excessive authentication attempts. The attack may be launched remotely but is difficult to exploit. The exploit is public. The project has not responded.
Risk Assessment
An attacker could perform a brute-force attack on authentication, potentially leading to account takeover or unauthorized access.
Recommendation
Apply a fix limiting authentication attempts or update the software when available.
Original NVD description (English source)
A vulnerability was detected in unitedbyai droidclaw up to 0.5.3. The affected element is an unknown function of the file server/src/routes/pairing.ts of the component claim Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.