CWE-307: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- go-vikunja vikunja Vikunja before 2.7.1 Password Brute-Force via TOTP Disable Endpoint 6.0 Medium
- ibm api connect Multiple Vulnerabilities in IBM API Connect 8.9 High
- chartbrew Chartbrew: Unauthenticated Brute Force of Password-Protected Dashboards Due to Missing Rate Limit and Plaintext Password Storage 7.5 High
- hisense vidaa Hisense VIDAA Smart TV MQTT Broker Authentication Bypass 7.2 High
- freescout-help-desk freescout FreeScout: Administrative tools.php endpoint is accessible to low-privileged users, enabling filesystem enumeration and unthrottled brute-force of application secrets 5.3 Medium
- hcl aion HCL AION is affected by multiple security vulnerabilities. 5.3 Medium
- infinitt healthcare ulite Brute-forceable image-share link password in INFINITT ULite 7.5 High
- campcodes bitcoin wallet system Campcodes Bitcoin Wallet System ForgotPasswordController.php random_int excessive authentication 6.3 Medium
- blueprintue blueprintue-self-hosted-edition BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 Login Rate Limit Bypass 6.3 Medium
- prosoft technology icx35-hwc-e, x35-hwc-a +1 more ProSoft ICX35 Login Lockout Bypass via Client-Side Cookies 8.2 High
- miroslavpejic85 mirotalk p2p miroslavpejic85 MiroTalk P2P Room Action server.js checkPassword excessive authentication 6.3 Medium
- team-alembic ash authentication AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resource 6.3 Medium
- pgadmin.org pgadmin 4 pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks 9.2 Critical
- dell openmanage enterprise Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Restriction of... 5.4 Medium
- delta electronics ufc500 Missing brute-force protection for web interface 5.3 Medium
- idvlabs software and consulting services inc. ontime OTP Brute-Force Account Takeover in Idvlabs Software's Ontime 5.3 Medium
- alexandregz twofactor gauthenticator Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator 6.3 Medium
- boneio Improper Restriction of Excessive Authentication Attempts in boneIO 2.3 Low
- nocodb NocoDB signup validatePassword excessive authentication 6.3 Medium
- yunaiv ruoyi-vue-pro YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication 6.3 Medium
- open-reception appointment-booking-software OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants 7.5 High
- codeigniter4 shield Shield - Moderately critical - Access bypass - SA-CONTRIB-2026-248 5.3 Medium
- apostrophecms apostrophe ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing 5.9 Medium
- advantech adam-3600 A vulnerability in the proprietary protocol could allow an attacker to brute force the... 8.2 High
- wso2 api manager, carbon user manager kernel, enterprise integrator +4 more +6 more Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery 4.8 Medium
- fossbilling FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint 6.9 Medium
- opencats OpenCATS Career Portal CareersUI.php processLogin excessive authentication 6.3 Medium
- thorsten phpmyfaq phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints 6.9 Medium
- thorsten phpmyfaq phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint 7.1 High
- xiaochong0302 course-tencent-cloud Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover 9.1 Critical
- magicblack maccms MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force 9.1 Critical
- lycheeorg lychee Lychee: Missing rate limiting on album password unlock endpoint allows brute-force attacks 7.5 High
- better-auth, better-auth drizzle-adapter, kysely-adapter +2 more Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition 6.3 Medium
- error311 filerise FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts 8.1 High
- error311 filerise FileRise: Rate Limiting Bypass via Username Rotation Enables Unlimited Password Spraying 6.5 Medium
- databasus Databasus 3.7.0 through 3.61.0 Account Takeover via Password Reset Brute-Force 9.2 Critical
- zimbra collaboration suite Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting 3.7 Low
- wazuh wazuh-manager Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition 6.9 Medium
- freerdp FreeRDP 3.0.0 before 3.32.0 PIN Brute-Force via Virtual Smartcard 7.1 High
- ibm i IBM i Information Disclosure 5.3 Medium
- netherman portal del hermano (portaldelhermano.es) Netherman Portal del Hermano Account Takeover via Password Reset Oracle 9.1 Critical
- phoenixthrush aniworld downloader AniWorld Downloader before 5.3.0 WebUI Login Brute Force via /login 6.9 Medium
- smp46 pingvin-share-x Pingvin Share X before 1.22.0 Ineffective Authentication Rate Limiting via Throttler TTL 6.9 Medium
- smp46 pingvin-share-x Pingvin Share X before 1.22.0 Rate Limit Bypass via Spoofed X-Forwarded-For 6.9 Medium
- hotspotbilling phpnuxbill PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code 9.3 Critical
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway +1 more Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an... 7.4 High
- ph7software ph7builder pH7Builder before 18.5.0 2FA Brute Force via VerificationCodeFormProcess.php 7.6 High
- payloadcms payload Payload: Unauthenticated account-lockout denial of service 6.9 Medium
- planka PLANKA 2.2.0 through 2.2.1 TOTP Brute Force via verify-totp Endpoint 9.1 Critical
- makeplane plane Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force 9.1 Critical
- Show olderLoading…