Weakness (CWE)
CWE-307: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
How to prevent it (2 mitigations)
-
Architecture and Design
Common protection mechanisms include:
- Disconnecting the user after a small number of failed attempts
- Implementing a timeout
- Locking out a targeted account
- Requiring a computational task on the user's part.
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]
Source: MITRE CWE-307
6 results · Clear filters · Feed
-
Critical 9.8CVE-2026-84473 Public exploit
CVE-2026-84473
Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentica…
-
Critical 9.8CVE-2025-56221 Public exploit
A lack of rate limiting in the login mechanism of SigningHub v8.6.8 allows attackers to bypass authentication via a bru…
-
Critical 9.8CVE-2024-41276 Public exploit
A vulnerability in Kaiten version 57.131.12 and earlier allows attackers to bypass the PIN code authentication mechanis…
-
Critical 9.8CVE-2023-27746 Public exploit
BlackVue DR750-2CH LTE v.1.012_2022.10.26 was discovered to contain a weak default passphrase which can be easily crack…
-
Critical 9.8CVE-2023-27100 Public exploit
Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v2…
-
Critical 9.8
An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5…