CVE-2026-71213 describes a missing rate-limiting vulnerability in Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login()). When captcha is disabled, which is the default configuration, no failed-attempt counting or account lockout mechanism is enforced on the primary password check. This allows unauthenticated attackers to perform unlimited brute-force password-guessing attacks against any account, including administrator accounts, with no throttling or blocking. The existing attempt-counting and lockout logic in the same codebase only protects an optional secondary email authentication code step and does not extend to the primary login step. This vulnerability poses a significant risk to all Typemill installations running with default settings.