CVE-2026-56450: Ail Project Ail Framework

Medium severity, CVSS 5.1. EPSS: 0.6% chance of exploitation in the next 30 days.

AIL did not restrict repeated failed attempts to verify a two-factor authentication (OTP) code. An attacker who had reached the 2FA verification step, such as after successfully completing the password-authentication stage, could submit an unlimited number of OTP guesses. This could enable brute-force guessing of a valid code and bypass the intended second authentication factor, resulting in unauthorized account access. The patch introduces per-user failed-OTP tracking, blocks verification after 30 failed attempts for one hour, clears the counter after a successful OTP verification, and provides administrator recovery actions to purge affected lockouts.

Affected products

• Ail Project Ail Framework: up to and including 6.8.0

Published 2026-06-22. Last modified 2026-06-22.