CVE-2025-35432 — CISA Thorium does not rate limit account verification email messages
CISA Thorium does not rate limit requests to send account verification email messages. A remote unauthenticated attacker can send unlimited messages to a user who is pending ver…
Published: 2025-09-17 · CVSS: 6.9 · CVSS 4.0
CISA Thorium does not rate limit requests to send account verification email messages. A remote unauthenticated attacker can send unlimited messages to a user who is pending verification. Fixed in 1.1.1 by adding a rate limit set by default to 10 minutes.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7