CVE-2026-33879 is a missing brute force protection flaw in the Federated Learning and Interoperability Platform (FLIP), an open source platform for medical imaging AI. NVD scores it 9.8. Review the maintainers' resolution note and confirm your deployment has the controls.
What's affected
The record says versions 0.1.1 and prior have a login page with no rate limiting or CAPTCHA. At publication it was unclear if a patch existed. The advisory now carries a note that the issue was closed on 2026-07-14. It lists rate limiting at the CloudFront edge through a WAF, a rate limiter on trust facing endpoints, and multi factor authentication enforced by default. The advisory still shows affected versions as all and no patched version, so verify what your deployment runs.
How to check if you're exposed
Test your login endpoint's behavior against repeated failed attempts from a test account in a non production copy, and review your deployment configuration for the WAF rate rule and the MFA setting named in the advisory.
What to do now
- Compare your deployment with the controls in the maintainers' resolution note.
- Turn on MFA for all users.
- Add per address rate limits at your edge.
- Review login logs for bursts of failures.
Why it matters
The record uses CWE-307, improper restriction of excessive authentication attempts. Users outside the organization raise credential reuse risk, so attackers can try passwords leaked elsewhere. MFA and throttling together cover it. The record is not marked as exploited in the wild and is not in CISA KEV.
Throttling should work at more than one layer. An edge rule slows bulk attempts from one address, an application limiter protects each account, and MFA makes a guessed password useless on its own. Because FLIP serves users outside the organization, also consider alerting on repeated failed logins for one account across many addresses, which edge rate limits alone do not catch.
Quick check
Is there a patched version?
The advisory lists none, but describes controls added in the deployment. Verify them.
Sources
Last reviewed: 19 October 2026.
