CVE-2026-33879

Federated Learning and Interoperability Platform (FLIP) is an open-source platform for federated training and evaluation of medical imaging AI models across healthcare institutions. The FLIP login page in versions 0.1.1 and prior has no rate limiting or CAPTCHA, enabling brute-force and credential-stuffing attacks. FLIP users are external to the organization, increasing credential reuse risk. As of time of publication, it is unclear if a patch is available.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/londonaicentre/FLIP/security/advisories/GHSA-p34f-488j-5cwv	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:aicentre:federated_learning_and_interoperability_platform:*:*:*:*:*:*:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Plataforma de Aprendizaje Federado e Interoperabilidad (FLIP) es una plataforma de código abierto para el entrenamiento y la evaluación federados de modelos de IA de imágenes médicas entre instituciones de atención médica. La página de inicio de sesión de FLIP en las versiones 0.1.1 y anteriores no tiene limitación de velocidad ni CAPTCHA, lo que permite ataques de fuerza bruta y de relleno de credenciales. Los usuarios de FLIP son externos a la organización, lo que aumenta el riesgo de reutilización de credenciales. En el momento de la publicación, no está claro si hay un parche disponible.

Information

Published : 2026-03-27 21:17

Updated : 2026-10-26 22:10

NVD link : CVE-2026-33879

Mitre link : CVE-2026-33879

CVE.ORG link : CVE-2026-33879

JSON object : View

Products Affected

aicentre

federated_learning_and_interoperability_platform

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2026-33879", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33879", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-30T15:36:32.083153Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "londonaicentre", "product": "FLIP", "versions": [{"status": "affected", "version": "<= 0.1.1"}]}]}], "published": "2026-03-27T21:17:24.537", "references": [{"url": "https://github.com/londonaicentre/FLIP/security/advisories/GHSA-p34f-488j-5cwv", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "Federated Learning and Interoperability Platform (FLIP) is an open-source platform for federated training and evaluation of medical imaging AI models across healthcare institutions. The FLIP login page in versions 0.1.1 and prior has no rate limiting or CAPTCHA, enabling brute-force and credential-stuffing attacks. FLIP users are external to the organization, increasing credential reuse risk. As of time of publication, it is unclear if a patch is available."}, {"lang": "es", "value": "Plataforma de Aprendizaje Federado e Interoperabilidad (FLIP) es una plataforma de c\u00f3digo abierto para el entrenamiento y la evaluaci\u00f3n federados de modelos de IA de im\u00e1genes m\u00e9dicas entre instituciones de atenci\u00f3n m\u00e9dica. La p\u00e1gina de inicio de sesi\u00f3n de FLIP en las versiones 0.1.1 y anteriores no tiene limitaci\u00f3n de velocidad ni CAPTCHA, lo que permite ataques de fuerza bruta y de relleno de credenciales. Los usuarios de FLIP son externos a la organizaci\u00f3n, lo que aumenta el riesgo de reutilizaci\u00f3n de credenciales. En el momento de la publicaci\u00f3n, no est\u00e1 claro si hay un parche disponible."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:aicentre:federated_learning_and_interoperability_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1D679AF-BC06-487B-BAE2-506A34303BDF", "versionEndExcluding": "0.1.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}