CWE-307: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- nagios fusionA lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2...7.6 High
- moodleMoodle: password brute force risk when mobile/web services enabled7.5 High
- ascertia signinghubA lack of rate limiting in the One-Time Password (OTP) verification endpoint of SigningHub v8.6.8...8.1 High
- ascertia signinghubA lack of rate limiting in the login mechanism of SigningHub v8.6.8 allows attackers to bypass...9.8 Critical
- jhumanj opnformJhumanJ OpnForm HTTP Header excessive authentication6.3 Medium
- sick baggage analytics, enterprise analytics, logistic diagnostic analytics +2 more +4 moreImproper Restriction of Excessive Authentication Attempts6.5 Medium
- extreme networks extremeguest essentialsExtremeGuest Essentials Captive Portal Unauthenticated Brute Force7.6 High
- polska akademia dostępności pad cmsBruteforce Protection Bypass in PAD CMS6.9 Medium
- access code project code, drupal access code +1 moreAccess code - Moderately critical - Access bypass - SA-CONTRIB-2025-1086.3 Medium
- ibm sterling connect:express for microsoft windows, sterling connect\ +1 moreIBM Sterling Connect:Express for Microsoft Windows information disclosure5.9 Medium
- airship ai acropolisAirship AI Acropolis MFA insufficient rate limiting7.7 High
- No product listedHarness Login Endpoint login excessive authentication6.3 Medium
- psmplugins supportcandy – helpdesk & customer support ticket systemSupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.7 - Authentication Bypass to Support Session Takeover6.5 Medium
- cognex in-sight explorer, in-sight 2000 series, in-sight 7000 series +2 more +4 moreCognex In-Sight Explorer and In-Sight Camera Firmware Improper Restriction of Excessive Authentication Attempts6.9 Medium
- solax power cloudBypass of bruteforce protection in SolaX Cloud6.3 Medium
- ethyca fidesFides Webserver API Rate Limiting Vulnerability in Proxied Environments6.3 Medium
- ethyca fidesFides Lacks Brute-Force Protections on Authentication Endpoints1.7 Low
- akinsoft taskpanoOTP Bypass in Akinsoft's TaskPano8.6 High
- akinsoft e-mutabakatOTP Bypass in Akinsoft's e-Mutabakat8.6 High
- akinsoft limondeskOTP Bypass in Akinsoft's LimonDesk8.6 High
- akinsoft myrezztaOTP Bypass in Akinsoft's MyRezzta8.6 High
- akinsoft myrezztaAuthentication Bypass in Akinsoft's MyRezzta9.8 Critical
- akinsoft prokuaforOTP Bypass in Akinsoft's ProKuafor8.6 High
- akinsoft octocloudOTP Bypass in Akinsoft's OctoCloud8.6 High
- akinsoft qr menuOTP Bypass in Akinsoft's QR Menu8.6 High
- drupal protected pages, protected pages project pages +1 moreProtected Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-1016.5 Medium
- mtons mblogmtons mblog password excessive authentication6.3 Medium
- mtons mblogmtons mblog Verification Code send_code excessive authentication6.3 Medium
soosyze/soosyzePackagistSoosyze CMS's /user/login endpoint missing rate-limiting and lockout mechanisms5.4 Medium- macrozheng mallmacrozheng mall Admin Login excessive authentication6.3 Medium
- eg4 electronics 12000xp, 12kpv, 18kpv +4 more +6 moreEG4 Electronics EG4 Inverters Improper Restriction of Excessive Authentication Attempts9.2 Critical
- openbaoOpenBao Login MFA Bypasses Rate Limiting and TOTP Token Reuse5.7 Medium
- openbaoOpenBao Userpass and LDAP User Lockout Bypass5.3 Medium
- triliumnext triliumTrilium Notes is Vulnerable to Brute-force Protection Bypass via Initial Sync Seed Retrieval7.5 High
- hashicorp vault, vault enterprise +1 moreVault Login MFA Bypass of Rate Limiting and TOTP Code Reuse5.7 Medium
- hashicorp vault, vault enterprise +1 moreVault Userpass and LDAP User Lockout Bypass5.3 Medium
- opexus foiaxpress public access link (pal), opexustech foiaxpress public access link +1 moreOPEXUS FOIAXpress Public Access Link (PAL) account-lockout and CAPTCHA protection bypass6.9 Medium
- grandstream ucm6510 firmwareGrandstream Networks UCM6510 v1.0.20.52 and before is vulnerable to Improper Restriction of...6.5 Medium
- ibm informix dynamic serverIBM Informix Dynamic Server information disclosure7.5 High
- mercusys mw301rMercusys MW301R Login excessive authentication2.3 Low
- eclipse glassfishEclipse GlassFish is vulnerable to Login Brute Force attacks through unlimited failed login attempts6.3 Medium
- drupal mail loginMail Login - Critical - Access bypass - SA-CONTRIB-2025-0889.8 Critical
- endress meac300-fnade4 firmware, endress+hauser meac300-fnade4 +1 moreCVE-2025-274567.5 High
- endress+hauser meac300-fnade4, endress meac300-fnade4 firmware +1 moreCVE-2025-274497.5 High
- endress meac300-fnade4 firmware, endress+hauser meac300-fnade4 +1 moreCVE-2025-17107.5 High
- filebrowserFile Browser Insecurely Handles Passwords5.9 Medium
- art-in bilişim teknolojileri ve yazılım hizm. tic. ltd. şti. wi-fi cloud hotspotAuthentication Bypass in Art-In Systems' Wi-Fi Cloud Hotspot9.3 Critical
- 201206030 novel-plusxxyopen/201206030 novel-plus CATCHA LoginController.java ajaxLogin authentication replay6.3 Medium
- aviatrix controllerAviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting...7.8 High
- yealink rps, ymcs +1 moreYealink YMCS RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force...2.2 Low
- Show moreLoading…