---
id: CVE-2026-119705
title: SerpBear before 3.1.1 Missing Authentication via POST /api/notify
summary: >-
  SerpBear before 3.1.1 contains a missing authentication vulnerability in
  pages/api/notify.ts that allows remote unauthenticated attackers to trigger
  notification emails because verifyUser() is never called. Attackers can
  repeatedly POST …
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-306
vendor: towfiqi
product: serpbear
affected:
  - serpbear < 3.1.1
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-30T18:27:22.414731Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T18:36:44.022Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119705'
references:
  - url: 'https://github.com/towfiqi/serpbear/issues/359'
    label: 'GitHub Issue #359'
  - url: 'https://github.com/towfiqi/serpbear'
  - url: >-
      https://github.com/towfiqi/serpbear/commit/12dc0a4bd91f06de2dab96f797c495942f7ef8c9
  - url: >-
      https://github.com/towfiqi/serpbear/blob/v3.1.0/pages/api/notify.ts#L16-L21
  - url: 'https://github.com/towfiqi/serpbear/releases/tag/v3.1.1'
    label: serpbear v3.1.1 Release Notes
  - url: >-
      https://www.vulncheck.com/advisories/serpbear-before-3.1.1-missing-authentication-via-post-api-notify
    label: >-
      VulnCheck Advisory: SerpBear before 3.1.1 Missing Authentication via POST
      /api/notify
tags:
  - cve.org
epss: 0.00626
epssPercentile: 0.50145
ingestedAt: '2026-11-05T16:24:31.337Z'
---

## Overview

SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because verifyUser() is never called. Attackers can repeatedly POST to /api/notify, optionally with a domain parameter, to exhaust SMTP rate limits, trigger provider abuse flags and flood recipients.

## Affected

- `serpbear < 3.1.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.