CWE-307: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- man-group dtalemangroup dtale Login Endpoint auth.py login excessive authentication6.3 Medium
- opensourcepos open source point of saleopensourcepos Open Source Point of Sale Login Endpoint Filters.php index excessive authentication6.3 Medium
- ibm langflow oss, langflow +1 moreInsufficient Authentication Brute Force Protection on Login Endpoint9.1 Critical
- hcl aionHCL AION is affected by multiple security vulnerabilities.5.6 Medium
- quanovate tech inc. (operating as mira / mira care) mira android app, mira firmware +1 moreMira Hormone Monitor, Mira Android App Improper restriction of excessive authentication attempts6.9 Medium
- apache rangerApache Ranger: UnixAuth lacks brute-force protection7.3 High
- open-reception appointment-booking-softwareOpenReception doesn't rate limit passphrase login attempts7.4 High
- open-reception appointment-booking-softwareOpenReception's client PIN challenge throttle is keyed by emailHash only, allowing cross-tenant lockout5.8 Medium
- unknown miniorange 2faminiOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor Attempts7.5 High
- typemilltypemill - No Rate Limiting on Login Endpoint Enables Unlimited Password Brute-Force9.1 Critical
- dgtlmoon changedetection.iochangedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force6.5 Medium
- papercut ng/mfPaperCut NG/MF: Insufficient brute-force protection6.9 Medium
- drupal disable login pageDisable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-1105.7 Medium
- @fastify/rate-limit, fastify fastify\/rate-limit +1 more@fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation7.3 High
- mikrotik cloud hosted router, routeros +1 moreImproper restriction of excessive authentication attempts in MikroTik RouterOS and Cloud Hosted Router8.7 High
- eshare eshareproBypass of application rate-limiting mechanism3.3 Low
- cp-plus ez-p21 ip cameraImproper Authentication Vulnerability in CP PLUS EZ-P21 IP Camera8.7 High
- universal software inc. flexcityOTP Bypass in Universal Sotware's FlexCity4.3 Medium
- datacycle-engine datacycle-coredataCycle No Brute-Force Protection On Web And API Login Endpoints7.3 High
- openclawOpenClaw 2026.2.25 < 2026.5.26 WebSocket Rate Limit Bypass6.3 Medium
- perforce delphix continuous dataImproper Restriction of Excessive Authentication Attempts in Delphix Continuous Data8.3 High
- pglombardo passwordpusherPasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottled Endpoint8.7 High
- hydro-québec le circuit electrique charging station backendHydro-Québec Le Circuit Electrique charging station backend Improper Restriction of Excessive Authentication Attempts8.7 High
- budda login disableLogin Disable - Moderately critical - Access bypass - SA-CONTRIB-2026-0705.4 Medium
- decolua 9router9router: Login brute-force protection bypass via spoofed X-Forwarded-For header7.3 High
- mycomplianceoffice mcoAccount Denial of Service in MCO6.3 Medium
- ktm system e-bokImproper Restriction of Excessive Authentication Attempts in KTM System e-BOK6.9 Medium
- payloadcmsPayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access5.3 Medium
- evoke csmsEVoke Systems EVoke CSMS Improper Restriction of Excessive Authentication Attempts8.7 High
github.com/gtsteffaniak/filebrowserGoFileBrowser: Missing Rate Limiting on Authentication Endpoint Enables Brute Force Attacks6.5 Medium- cap-go capgoCapgo - Password Spraying via Public-Key Accessible Credential Validation Endpoint6.9 Medium
- ail project frameworkAIL Framework - Missing Rate Limiting Enables Brute-Force Attacks Against Two-Factor Authentication Codes5.1 Medium
- craftcms commerceCraft Commerce: Coupon Code Brute-Force via Rate Limit Bypass6.9 Medium
- başbelen group food cafe businesses industry and trade ltd. co. pause+ mobile appOTP Bypass in Başbelen Group's Pause+ Mobile App9.8 Critical
- sonatype nexus repository managerNexus Repository Manager - Improper Restriction of Excessive Authentication Attempts8.7 High
- drupal brute force attack protectionBrute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-0475.9 Medium
- nocodbNocoDB: User Enumeration via Sign-In Timing6.3 Medium
- fossbillingFOSSBilling's password reset confirmation endpoint lacks rate limiting6.3 Medium
- No product listedMercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 enables WPS 2.0 by default with a weak...6.4 Medium
- No product listedMercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute...8.8 High
- unitedbyai droidclawunitedbyai droidclaw claim Endpoint pairing.ts excessive authentication6.3 Medium
- autheliaAuthelia Missing Username Canonicalization in Basic Auth (LDAP)2.9 Low
- indian motorcycle scout bobber + techIndian Scout Bobber 2025 WCM brute-force4.1 Medium
- india-web-developer login with otpLogin with OTP <= 1.6 - Unauthenticated Authentication Bypass via OTP Brute Force9.8 Critical
- spaceapplications yamcsYamcs: No Rate Limiting on Authentication Endpoint6.5 Medium
- gardyn mobile applicationOTP Bypass in TEİAŞ's Mobile Application6.3 Medium
- thorsten phpmyfaqphpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update8.8 High
- yerootech ids6 dsspro digital signage systemiDS6 DSSPro Digital Signage System 6.2 CAPTCHA Security Bypass9.3 Critical
- better-authBetter Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation7.3 High
- hcl aionHCL AION is affected by a vulnerability where adequate protections against brute-force attempts are not enforced.5.4 Medium
- Show moreLoading…