CryptPad vulnerabilities
We track 2 vulnerabilities in CryptPad products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on April 30, 2026.
2vulnerabilities
1critical
1high
0exploited
8.3average CVSS score
Latest CryptPad vulnerabilities
- 7.5 High severity
CryptPad: Allocation of Resources Without Limits or Throttling
CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade or deny service for all users of a CryptPad instance. Fixed in 2026.2.2.
- 9.1 Critical severity
cryptpad: Improper Access Control
CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication (2FA) in CryptPad can be trivially bypassed, due to weak implementation of access controls. An attacker that compromises a user's credentials can gain access