CWE-799: Insufficient anti-automation
The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.
Also known as Improper Control of Interaction Frequency, Brute force.
A kind of CWE-691 Insufficient Control Flow Management.
From the CWE List. © The MITRE Corporation.
Newest
- campcodes bitcoin wallet system Campcodes Bitcoin Wallet System ForgotPasswordController.php random_int excessive authentication 6.3 Medium
- miroslavpejic85 mirotalk p2p miroslavpejic85 MiroTalk P2P Room Action server.js checkPassword excessive authentication 6.3 Medium
- wso2 api manager, carbon identity management, carbon user manager kernel +1 more +3 more Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks 4.8 Medium
- roostorg coop Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg 6.9 Medium
- nocodb NocoDB signup validatePassword excessive authentication 6.3 Medium
- yunaiv ruoyi-vue-pro YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication 6.3 Medium
- baserproject basercms baserCMS: Public Web API mail-form submission bypasses image CAPTCHA 5.3 Medium
- openbao OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing 6.3 Medium
- opencats OpenCATS Career Portal CareersUI.php processLogin excessive authentication 6.3 Medium
- banq jivejdon Jivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS Endpoint 6.9 Medium
- pusula communication, it, and internet industry and trade co. ltd. expert mail PII Enumeration via Missing Rate Limiting in Pusula Communication's Expert Mail 5.3 Medium
- arraytics wp event solution WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability 6.5 Medium
- linlinjava litemall linlinjava litemall Login Endpoint AdminAuthController.java excessive authentication 6.3 Medium
- openclaw clawhub ClawHub before 8c2de6c506 Skill Hiding via Coordinated Reports 8.7 High
- zammad Zammad: Missing rate limiting allows password brute-forcing during two-factor login 6.9 Medium
- drupal webform Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171 5.3 Medium
- saleor Saleor throttling.py get_client_ip excessive authentication 6.3 Medium
- ibm ts4300 TS4300 Tape Library addresses security vulnerability 4.3 Medium
- ibm sterling partner engagement manager essentials edition, sterling partner engagement manager standard edition +1 more Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager. 5.3 Medium
- affine monorepo OmniBlocks: Spamming in Discussions tab possible via disc.yml 5.3 Medium
- thorsten phpmyfaq phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter 6.9 Medium
- lemmynet lemmy Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo 6.5 Medium
- karakeep-app karakeep karakeep-app karakeep Login Endpoint auth.ts authorize excessive authentication 6.3 Medium
- victoriametrics VictoriaMetrics VMAuth Authentication Endpoint main.go requestHandler excessive authentication 6.3 Medium
- man-group dtale mangroup dtale Login Endpoint auth.py login excessive authentication 6.3 Medium
- opensourcepos open source point of sale opensourcepos Open Source Point of Sale Login Endpoint Filters.php index excessive authentication 6.3 Medium
- hcl software aftermarket epc HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper... 5.3 Medium
- wazuh Wazuh: Rate Limit Bypass via /events Endpoint 4.3 Medium
- mia technology inc. pizzy library Missing Rate Limiting in Mia Technologies' Pizzy Library 7.1 High
- unitedbyai droidclaw unitedbyai droidclaw claim Endpoint pairing.ts excessive authentication 6.3 Medium
- codewise tornet scooter mobile app CodeWise Tornet Scooter Mobile App TwoFactor excessive authentication 6.3 Medium
- meware software development inc. pdks Improper Rate Limiting in MeWare Software's PDKS 8.1 High
- openclaw OpenClaw 2026.2.26 < 2026.3.31 - Denial of Service via Improper Pending Pairing Request Cap Enforcement 6.3 Medium
- openclaw OpenClaw < 2026.3.31 - Authentication Rate Limiting Bypass via Fake DeviceToken 6.3 Medium
- openclaw OpenClaw < 2026.3.31 - Denial of Service via LINE Webhook Handler Pre-Auth Concurrency 6.9 Medium
- hcl aftermarket dpc, hcltech aftermarket cloud +1 more HCL Aftermarket DPC is affected by Spamming Vulnerability 4.3 Medium
- runtipi Runtipi has a TOTP two-factor authentication bypass via unrestricted brute-force on `/api/auth/verify-totp` 8.1 High
- ibm aspera console IBM Aspera Console Denial of Service 5.3 Medium
- gvectors wpdiscuz wpDiscuz before 7.6.47 - No Rate Limiting on Subscription Endpoints with LIKE Wildcard Bypass 6.9 Medium
- parse-community parse-server Parse Server has a rate limit bypass via batch request endpoint 6.9 Medium
- fortinet fortiweb An Improper Control of Interaction Frequency vulnerability [CWE-799] vulnerability in Fortinet... 7.3 High
-
openclawnpm OpenClaw's hooks count non-POST requests toward auth lockout 5.3 Medium - swiftbuy Tasin1025 SwiftBuy login.php excessive authentication 6.3 Medium
- d-link dir-823x, dlink dir-823x firmware +1 more D-Link DIR-823X Login sub_40AC74 excessive authentication 6.3 Medium
- beetel 777vr1, 777vr1 firmware +1 more Beetel 777VR1 UART excessive authentication 1.0 Low
- ibm aspera orchestrator IBM Aspera Orchestrator Denial of Service 5.3 Medium
- ascertia signinghub In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the reset password... 9.8 Critical
- logicaldoc community edition, logicaldoc +1 more LogicalDOC Community Edition Admin Login login.jsp excessive authentication 6.3 Medium
- No product listed VirtFusion Email Change _settings excessive authentication 6.9 Medium
- jhumanj opnform JhumanJ OpnForm HTTP Header excessive authentication 6.3 Medium
- Show olderLoading…