CVE-2026-33640 is a rate limiting weakness in Outline, the collaborative documentation service, that lets an attacker guess six digit email login codes and take over accounts. NVD scores it 9.8. It affects versions from 0.86.0 up to but not including 1.6.0. Upgrade to 1.6.0.
What's affected
The NVD record says Outline versions starting at 0.86.0 and before 1.6.0 are affected. The GitHub advisory lists the affected range as 0.86.0 to 1.6.0 and the patched version as 1.6.0, which was released on 15 March according to the release page.
Only workspaces that use the Email OTP login flow are in scope. The advisory describes it as the flow for users who are not associated with an identity provider. If every user signs in through your identity provider, this path is not the one your users take, though you should still upgrade.
How to check if you're exposed
Find the Outline version you deploy. For a Docker based install, read the image tag in your compose file or run:
docker ps --format '{{.Image}}'
Anything from 0.86.0 up to before 1.6.0 needs the update. Then look at your sign in settings. If email login is enabled for people who do not use single sign on, those accounts are the ones at risk.
The advisory also points at deployment details. Check that the RATE_LIMITER_ENABLED=true setting is present in your environment file, and that a correctly configured reverse proxy sits in front of Outline so that clients cannot set their own forwarded address header. An instance with rate limiting disabled is exposed to the same brute force.
What to do now
- Upgrade Outline to 1.6.0 or later.
- Enable single sign on for users where you can, so fewer accounts depend on email codes.
- Confirm your reverse proxy overwrites client supplied forwarded headers instead of passing them through.
- Review authentication logs for bursts of failed email login callbacks from before the upgrade, and for sign ins you do not recognise.
- If you find suspicious sign ins, end active sessions for the affected accounts and review recent document changes.
Why it matters
The record files this as CWE-307, improper restriction of excessive authentication attempts. A six digit code has 900,000 possible values. The advisory says each code lives for ten minutes, so the only real defense against guessing is limiting how many tries an attacker gets.
Outline did not invalidate a code after repeated bad submissions. It relied on the rate limiter alone, and the advisory describes two ways around that limiter. One abused a rate limit key built from an unverified cookie value. The other abused a forwarded address header on deployments with a missing or misconfigured proxy. Either way an attacker could keep trying within the code's lifetime.
The lasting lesson is to put the limit on the secret, not only on the request path. A code that dies after a handful of wrong guesses stays safe even when a front layer fails. The record is not marked as exploited in the wild and is not in the CISA KEV catalog.
Quick check
Does this affect single sign on users?
The advisory describes the issue in the Email OTP flow used by people without an identity provider. Upgrade regardless.
What fixes it?
Outline 1.6.0 is the patched version listed in the advisory.
Sources
Last reviewed: 19 October 2026.
