CWE-307: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
openclawnpmOpenClaw's hooks count non-POST requests toward auth lockout5.3 Medium- everon api.everon.ioEveron api.everon.io Improper Restriction of Excessive Authentication Attempts8.7 High
- mobiliti e-mobi.hu, mvm mobiliti e-mobi.hu +1 moreMobiliti e-mobi.hu Improper Restriction of Excessive Authentication Attempts8.7 High
- epower epower.ieePower epower.ie Improper Restriction of Excessive Authentication Attempts8.7 High
- rustdesk, rustdesk-client rustdesk client +1 moreRustDesk Auth Proof Uses Server-Controlled Salt/Challenge and Fast Double-SHA256, Enabling Offline Brute-Force5.7 Medium
- dani-garcia vaultwardenVaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement6.0 Medium
- sysadminsmedia homeboxHomeBox has an Auth Rate Limit Bypass via IP Spoofing7.4 High
- openclawOpenClaw < 2026.2.25 - Password Brute-Force via Browser-Origin WebSocket Authentication Bypass7.5 High
- hcltech devops planIBM DevOps Plan is vulnerable to Excessive Authentication Attempts5.9 Medium
- calibre-ebook calibrecalibre has IP Ban Bypass via X-Forwarded-For Header Spoofing5.3 Medium
- shenzhen hongyavision technology co., ltd. (sodola networks) sodola sl902-swtgw124as, sodola-network sl902-swtgw124as firmware +1 moreSODOLA SL902-SWTGW124AS <= 200.1.20 Improper Login Rate Limiting6.9 Medium
- mobility46 mobility46.seMobility46 mobility46.se Improper Restriction of Excessive Authentication Attempts8.7 High
- ev energy ev.energyEV Energy ev.energy Improper Restriction of Excessive Authentication Attempts8.7 High
- switch ev swtchenergy.comSWITCH EV swtchenergy.com Improper Restriction of Excessive Authentication Attempts8.7 High
- ev2go ev2go.ioEV2GO ev2go.io Improper Restriction of Excessive Authentication Attempts8.7 High
- cloudcharge cloudcharge.seCloudCharge cloudcharge.se Improper Restriction of Excessive Authentication Attempts8.7 High
- chargemap chargemap.comChargemap chargemap.com Improper Restriction of Excessive Authentication Attempts8.7 High
- videolan vlc for androidVLC for Android < 3.7.0 Remote Access OTP Authentication Bypass6.3 Medium
- binardat ltd. 10g08-0800gsm network switch, binardat 10g08-0800gsm firmware +1 moreBinardat 10G08-0800GSM Network Switch Missing Login Rate Limiting6.9 Medium
- doruk communication and automation industry and trade inc. wispotterOTP Password Brute Forcing in DorukNet's Wispotter5.3 Medium
- emmett-framework coreEmmett has an Unhandled CookieError Exception Causing Denial of Service7.5 High
- swiftbuyTasin1025 SwiftBuy login.php excessive authentication6.3 Medium
- moodleMoodle: moodle: brute-force facilitation due to missing rate limiting in confirmation email service7.5 High
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X Login sub_40AC74 excessive authentication6.3 Medium
- shenzhen tenda technology co., ltd. w30e v2, tenda w30e firmware +1 moreTenda W30E V2 Lacks Rate Limiting on Authentication9.2 Critical
- beetel 777vr1, 777vr1 firmware +1 moreBeetel 777VR1 UART excessive authentication1.0 Low
- birebirsoft software and technology solutions sufirmamImproper Access Control in Birebirsoft's Sufirmam9.4 Critical
- evmapaEVMAPA Improper Restriction of Excessive Authentication Attempts7.5 High
- dell powerscale onefsDell PowerScale OneFS versions prior to 9.13.0.0 contains an improper restriction of excessive...8.1 High
- openprojectOpenProject has no protection against brute-force attacks in the Change Password function6.9 Medium
- gl-inet ax1800 firmwareAn issue in GL Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. GL.Inet AX1800 Version 4...6.5 Medium
- gl-inet ax1800 firmwareThe LuCI web interface on Gl Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. Fix...5.1 Medium
- restajet online food delivery systemImproper Authentication in Restajet's Online Food Delivery System9.1 Critical
- dbitnet dbit n300 t1 pro firmwareAn issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version...6.5 Medium
- misskeyMisskey has a login rate limit bypass via spoofed X-Forwarded-For header6.9 Medium
- wbce cmsWBCE CMS allows brute-force protection bypass using X-Forwarded-For header6.3 Medium
- circl vulnerability-lookupImproper Restriction of Excessive Authentication Attempts vulnerability in CIRCL Vulnerability-Lookup8.1 High
- dell cloudboost virtual applianceDell CloudBoost Virtual Appliance, versions 19.13.0.0 and prior, contains an Improper Restriction...7.0 High
- medtronic carelink networkMedtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force...8.1 High
- seiko epson corporation epson web control for seiko epson projector products, epson webconfig for seiko epson projector products +1 moreEPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products do not restrict...9.3 Critical
- 2dogz bloginAn issue was discovered in weijiang1994 university-bbs (aka Blogin) in commit...9.8 Critical
- jcd windu cms, windu cms +1 moreBruteforce Protection Bypass in Windu CMS6.9 Medium
- schneider electric powerchute™ serial shutdownCWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that...6.9 Medium
- turkguven software technologies inc. perfektiveAuthentication Bypass in Turkguven's Perfektive7.3 High
- solidigm™ d5-p5316, d7-p5510, d7-p5520/d7-p5620, d5-p5430, d5-p5336Improper resource management in firmware of some Solidigm DC Products may allow an attacker with...4.4 Medium
- logicaldoc community edition, logicaldoc +1 moreLogicalDOC Community Edition Admin Login login.jsp excessive authentication6.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal vulnerable to password enumeration6.3 Medium
- zitadelZitadel allows brute-forcing authentication factors7.7 High
- No product listedVirtFusion Email Change _settings excessive authentication6.9 Medium
- ping identity pingfederatePingFederate unexpected browser flow initiation in redirectless mode0.0 None
- Show moreLoading…