CWE-307: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- linlinjava litemalllinlinjava litemall Login Endpoint AdminAuthController.java excessive authentication6.3 Medium
- monta monta.appMonta monta.app Improper Restriction of Excessive Authentication Attempts8.7 High
- eugeny russhRussh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path3.7 Low
- nginxproxymanager nginx-proxy-managerNginx Proxy Manager through 2.16.0 Missing Brute-Force Protection9.1 Critical
- stoatchatstoatchat before 0.15.5 MFA Brute Force via Insufficient Rate Limiting8.3 High
- pawelmalak flameFlame through 2.4.0 Brute-Force Attack via Login Endpoint8.3 High
- glpi-project glpiGLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force7.7 High
- zammadZammad: Missing rate limiting allows password brute-forcing during two-factor login6.9 Medium
- hkuds lightragLightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks9.1 Critical
- decolua 9router9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header5.3 Medium
- No product listedImproper Restriction of Excessive Authentication Attempts in the administration login of...6.5 Medium
- laurent22 joplinJoplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint9.1 Critical
- devolutions server@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`6.8 Medium
- steveiliop56 tinyauthTinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service5.3 Medium
- saleorSaleor throttling.py get_client_ip excessive authentication6.3 Medium
- synology diskstation manager (dsm)An improper restriction of excessive authentication attempts vulnerability in Auto block in...3.7 Low
- hcl software bigfix service managementHCL BigFix Service Management is affected by multiple security vulnerabilities.6.5 Medium
- wwbn avideoAVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter Increment6.9 Medium
- go-vikunja vikunjaVikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth8.7 High
- go-vikunja vikunjaVikunja before 2.6.0 Authentication Bypass via Unthrottled API8.7 High
- payara serverPayara Server is vulnerable to brute-force login attacks due to the absence of a limit on failed login attempts6.3 Medium
- kingdom communication associated eh1000b, eh2070, eh3040 +1 more +3 moreKingdom Communication Associated｜Smart Video Intercom System - Missing Burte-force Protection8.7 High
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts6.5 Medium
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 moreDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior...7.5 High
- wwbn avideoWWBN AVideo Unrestricted Authentication Attempts via get_api_preauthorize9.1 Critical
- bahçelievler muncipality bihayat appOTP Bypass in Bahçelievler Muncipality's BiHayat App9.4 Critical
- mediatek, inc. mediatek chipsetIn Audio HAL, there is a possible information disclosure due to a missing permission check. This...4.4 Medium
- mediatek, inc. mediatek chipsetIn Audio HAL, there is a possible escalation of privilege due to improper input validation. This...6.7 Medium
- wwbn avideoAVideo API Rate Limit Bypass via Bot User-Agent Header6.3 Medium
- mispMissing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass8.6 High
- schneider electric powerchute™ serial shutdownCWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that...6.9 Medium
- rockwell automation factorytalk® activation managerRockwell Automation FactoryTalk® Activation Manager - Privilege Escalation8.5 High
- wwbn avideoWWBN AVideo Brute-force Rate Limiting Bypass via Missing User-Agent8.7 High
- wwbn avideoWWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php6.9 Medium
- adobe dimensionWatchGuard Dimension Web UI Authentication Brute-Force Due to Missing Rate Limiting6.3 Medium
- ebyte na111-m firmwareEbyte NA111-M Improper Restriction of Excessive Authentication Attempts8.7 High
- baptistearno typebot.ioTypeBot: Account takeover via brute-forceable 6-digit magic-link code9.1 Critical
- No product listedPunk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session9.1 Critical
- rocket.chatRocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method6.9 Medium
- ransomlookRansomLook Login Endpoint Allows Timing-Based Username Enumeration and Unthrottled Authentication Attempts8.8 High
- hclsoftware hcl hiveHCL Hive is affected by a missing rate limit5.3 Medium
- monkeytypegame monkeytypeMonkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)7.5 High
- phpmyfaqphpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle9.1 Critical
- alextselegidis plainpadPlainpad Missing Rate Limiting via POST /v1/sessions6.9 Medium
- karakeep-app karakeepkarakeep-app karakeep Login Endpoint auth.ts authorize excessive authentication6.3 Medium
- siyuan-note siyuanSiYuan before 3.7.4 Brute-Force Authentication via Publish Service8.7 High
- siyuan-note siyuanSiYuan kernel before 3.7.4 Unthrottled Brute-Force via API Token9.3 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Authentication Bypass via HTTP Basic Auth9.3 Critical
- siyuan-note siyuanSiYuan before 3.7.4 Brute-Force via authFilePublishAccess8.7 High
- victoriametricsVictoriaMetrics VMAuth Authentication Endpoint main.go requestHandler excessive authentication6.3 Medium
- Show moreLoading…