SZB-9569ce3a6e
EUVD flags missing authentication in SerpBear before 3.1.1 (CVSS 6.9)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- SerpBear
- Product
- SerpBear
- First seen
Summary
The EUVD (ENISA) database has published EUVD-2026-114110 for SerpBear before 3.1.1. It describes a missing authentication flaw in pages/api/notify.ts that could let unauthenticated remote attackers trigger notification emails.
If you use SerpBear
Upgrade SerpBear to version 3.1.1 or later
Restrict access to the /api/notify endpoint at the network or proxy level until patched
Review notification email logs for unexpected sends
What the sources say 1
· Mastodon: “SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because verifyUser() is never called.” Source