CWE-307: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- opnsense, opnsense core +1 moreOPNsense: Authentication lockout bypass5.3 Medium
- strapi, strapi @strapi/plugin-users-permissions +1 moreStrapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying6.9 Medium
- zyxel wre6505 v2 firmware, wre6505 firmware +1 more** UNSUPPORTED WHEN ASSIGNED ** An improper restriction of excessive authentication attempts...6.5 Medium
- dani-garcia vaultwardenVaultwarden: Brute-force protection bypass vulnerability7.3 High
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Account-lockout bypass via Flask-Security default /login view6.9 Medium
- hitachi virtual storage platform e390, e590, e790, e990, e1090, e390h, e590h, e790h, e1090h, virtual storage platform g130, g150, g350, g370, g700, g900, f350, f370, f700, f900, virtual storage platform one block 23, one block 24, one block 26, one block 28 +20 more +22 moreImproper Restriction of Excessive Authentication Attempts vulnerability in Hitachi Virtual Storage Platform5.3 Medium
- thorsten phpmyfaqphpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check Endpoint9.3 Critical
- open-emr openemrOpenEMR 7.0.1 Authentication Brute Force Mitigation Bypass8.7 High
- signalk signal k server, signalk-server +1 moreSignal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)8.7 High
- codewise tornet scooter mobile appCodeWise Tornet Scooter Mobile App TwoFactor excessive authentication6.3 Medium
- u-speed n300 firmwareU-SPEED N300 router V1.0.0 does not implement rate limiting or account lockout protections on the...7.5 High
- wazuhWazuh: API brute-force protection bypass via race condition in login attempt tracking6.5 Medium
- mercurycom mipc252w firmwareThe RTSP service of MERCURY IP camera MIPC252W 1.0.5 Build 230306 has an issue handling failed...6.2 Medium
- d-link dwm-222wD-Link｜DWM-222W USB Wi-Fi Adapter - Brute-Force Protection Bypass8.7 High
- blueprintue blueprintue-self-hosted-editionblueprintUE: Login Endpoint Has No Rate Limiting, Lockout, or Brute-Force Protection7.5 High
- fortra goanywhere mft, goanywhere managed file transfer +1 moreHTML Injection possible in system generated emails in Fortra's GoAnywhere MFT5.4 Medium
- fortra goanywhere mft, goanywhere managed file transfer +1 moreGoAnywhere MFT SFTP Service Login Vulnerable to Brute Force Attack Under Certain Circumstances7.3 High
- quantum networks router qn-i-470, qntmnet qn-i-470 firmware +1 moreMissing Rate Limiting Vulnerability in Quantum Networks Router QN-I-4708.7 High
- churchcrm crmChurchCRM: Username Enumeration via Differential Response in Public Login API5.3 Medium
- dell data domain operating system, powerprotect data domain +1 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...6.2 Medium
- node-oauth node-oauth2-server, node-oauth\/oauth2-server +1 more@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes5.9 Medium
- eaton intelligent power protector, ipp software +1 moreEaton Intelligent Power Protector (IPP) software allows repeated authentication attempts against...6.5 Medium
- openprojectOpenProject: 2FA OTP Verification Missing Rate Limiting7.4 High
- schneider electric powerchute™ serial shutdown, schneider-electric powerchute serial shutdown +1 moreCWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would...6.9 Medium
- hclsoftware velocity, hcltech devops velocity +1 moreHCL DevOps Velocity is susceptible to brute-force attacks6.8 Medium
- go-vikunja vikunjaVikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout5.9 Medium
- openclawOpenClaw < 2026.3.31 - Authentication Rate Limiting Bypass via Fake DeviceToken6.3 Medium
- openclawOpenClaw < 2026.3.28 - Brute Force Attack via Missing Rate Limiting on Webhook Shared Secret Authentication6.3 Medium
- openclawOpenClaw < 2026.3.25 - Pre-Authentication Rate-Limit Bypass in Webhook Token Validation6.3 Medium
- openclawOpenClaw < 2026.3.25 - Brute-Force Attack via Missing Telegram Webhook Rate Limiting6.3 Medium
- openclawOpenClaw < 2026.3.25 - Brute-Force Attack via Missing Webhook Password Rate Limiting6.3 Medium
- aicentre federated learning and interoperability platform, londonaicentre flip +1 moreFLIP doesn't have rate limiting or brute-force protection on login2.7 Low
- franklioxygen mytubeMyTube has Unauthenticated Account Lockout via Shared Login Attempt State7.7 High
- getoutline outlineOutline has a rate limit bypass that allows brute force of email login OTP9.1 Critical
- tandoor recipesTandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthentication9.1 Critical
- wwbn avideoAVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean Oracle5.3 Medium
- nexxt solutions nebula 300+, nexxtsolutions nebula300plus firmware +1 moreNexxt Nebula 300+ - Lack of Rate Limiting Enables Brute-Force Attacks7.7 High
- igl eparking.fiIGL-Technologies eParking.fi Improper Restriction of Excessive Authentication Attempts8.7 High
- ctek chargeportal, charge portal +1 moreCTEK Chargeportal Improper Restriction of Excessive Authentication Attempts8.7 High
- minioMinIO: LDAP login brute-force via user enumeration and missing rate limit9.1 Critical
- jetkvm, jetkvm kvm +1 moreJetKVM insufficient login rate limiting9.3 Critical
- gl-inet comet kvm, comet gl-rm1 firmware +1 moreGL-iNet Comet (GL-RM1) KVM insufficient login rate-limiting9.3 Critical
- raythaLack of bruteforce protection in Raytha CMS6.9 Medium
- runtipiRuntipi has a TOTP two-factor authentication bypass via unrestricted brute-force on `/api/auth/verify-totp`8.1 High
- openclawOpenClaw < 2026.3.12 - Webhook Rate Limiting Bypass via Pre-Authentication Secret Validation6.9 Medium
- anyproto anytype-cli, anytype-heart, anytype cli +3 more +5 moreImproper Restriction of Excessive Authentication Attempts in github.com/anyproto/anytype-heart3.6 Low
- git-for-windows gitGit for Windows leaks NTLM hash when cloning from an attacker-controlled server7.4 High
- fortinet fortianalyzer, fortianalyzer cloud, fortimanager +1 more +3 moreAn improper restriction of excessive authentication attempts vulnerability in Fortinet...3.4 Low
- hackerbay oneuptimeOneUptime has WhatsApp Resend Verification Authorization Bypass5.3 Medium
- telekom account management portalIncorrect Access Control via missing 2FA rate-limiting allowing unlimited brute-force retries and...9.1 Critical
- Show moreLoading…