Weakness (CWE)
CWE-307: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
How to prevent it (2 mitigations)
-
Architecture and Design
Common protection mechanisms include:
- Disconnecting the user after a small number of failed attempts
- Implementing a timeout
- Locking out a targeted account
- Requiring a computational task on the user's part.
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]
Source: MITRE CWE-307
33 results · Clear filters · Feed
-
High 8.1CVE-2026-103977 Public exploit
FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise stores failed TOTP verification attempts in $_SESSION. An attacker who already possesses a target account's valid primary credent…
-
High 7.4CVE-2026-102334 Public exploit
Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection
Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently gu…
-
Medium 6.5CVE-2026-71205 Public exploit
changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force
changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt).
-
Medium 6.9CVE-2026-8793 Public exploit
PaperCut NG/MF: Insufficient brute-force protection
PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vulnerability to perform unrestricted brute-force or credential-stuffing attacks without triggering acc…
-
Medium 6.5CVE-2026-44596 Public exploit
Yamcs: No Rate Limiting on Authentication Endpoint
Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, account lockout, or failed-attempt throttlin…
-
High 7.3CVE-2026-43914 Public exploit
Vaultwarden: Brute-force protection bypass vulnerability
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows bypassing the login brute-force protection if email 2fa is enabled. If email 2fa is enabled, the unprotected 2fa-functi…
-
Low 3.7CVE-2026-7671 Public exploit
CodeWise Tornet Scooter Mobile App TwoFactor excessive authentication
A vulnerability has been found in CodeWise Tornet Scooter Mobile App 4.75 on iOS/Android. The impacted element is an unknown function of the file /TwoFactor. Such manipulation leads to improper restriction of excessive authentication attempts. The attack may …
-
High 7.5CVE-2026-36959 Public exploit
U-SPEED N300 router V1.0.0 does not implement rate limiting or account lockout protections on the /api/login endpoint. …
-
High 7.5CVE-2026-27778 Public exploit
ePower epower.ie Improper Restriction of Excessive Authentication Attempts
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, o…
-
Medium 6.5CVE-2025-65427 Public exploit
An issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version V1.0.0 does not implem…
-
Medium 6.3CVE-2025-66204 Public exploit
WBCE CMS allows brute-force protection bypass using X-Forwarded-For header
WBCE CMS is a content management system. Version 1.6.4 contains a brute-force protection bypass where an attacker can indefinitely reset the counter by modifying `X-Forwarded-For` on each request, gaining unlimited password guessing attempts, effectively bypa…
-
High 7.6CVE-2025-60424 Public exploit
A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to by…
-
High 8.1CVE-2025-56224 Public exploit
A lack of rate limiting in the One-Time Password (OTP) verification endpoint of SigningHub v8.6.8 allows attackers to b…
-
Critical 9.8CVE-2025-56221 Public exploit
A lack of rate limiting in the login mechanism of SigningHub v8.6.8 allows attackers to bypass authentication via a bru…
-
Medium 6.5CVE-2025-10658 Public exploit
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.7 - Authentication Bypass to Support Session Takeover
The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.3.7. This is due to missing rate limiting on the OTP verification for guest login. This makes it p…
-
Medium 5.4CVE-2025-52392 Public exploit
Soosyze CMS's /user/login endpoint missing rate-limiting and lockout mechanisms
Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can repeatedly submit login attempts without restrictions, potentially gaining unauthorized administrative access. T…
-
Medium 5.4CVE-2023-34732 Public exploit
An issue in the userId parameter in the change password function of Flytxt NEON-dX v0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c …
-
High 7.5CVE-2024-57610 Public exploit
A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user acc…
-
High 8.6CVE-2024-5716 Public exploit
Logsign Unified SecOps Platform Authentication Bypass Vulnerability
Logsign Unified SecOps Platform Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Logsign Unified SecOps Platform. Authentication is not required to exploit this vulnerability…
-
Critical 9.8CVE-2024-41276 Public exploit
A vulnerability in Kaiten version 57.131.12 and earlier allows attackers to bypass the PIN code authentication mechanis…
-
Medium 6.5CVE-2024-45589 Public exploit
RapidIdentity LTS through 2023.0.2 and Cloud through 2024.08.0 improperly restricts excessive authentication attempts a…
-
Medium 6.5CVE-2024-32868 Public exploit
ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass
ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already gives administrators the option to define a `Lockout Policy` with a maximum amount of failed password ch…
-
Medium 5.3CVE-2023-49792 Public exploit
Bruteforce protection can be bypassed with misconfigured proxy
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when a…
-
Medium 5.3CVE-2022-30076 Public exploit
ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student username…
-
Critical 9.8CVE-2023-27746 Public exploit
BlackVue DR750-2CH LTE v.1.012_2022.10.26 was discovered to contain a weak default passphrase which can be easily crack…
-
High 7.8CVE-2023-1665 Public exploit
Improper Restriction of Excessive Authentication Attempts in linagora/twake
Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 0.0.0.
-
Critical 9.8CVE-2023-27100 Public exploit
Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v2…
-
Low 3.5CVE-2023-26209 Public exploit
A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiDeceptor 3.1.x and…
-
Low 3.5CVE-2023-26208 Public exploit
A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiAuthenticator 6.4.…
-
Low 3.5CVE-2022-29056 Public exploit
A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiMail version 6.4.0…
-
High 7.8CVE-2023-0860 Public exploit
Improper Restriction of Excessive Authentication Attempts in modoboa/modoboa-installer
Improper Restriction of Excessive Authentication Attempts in GitHub repository modoboa/modoboa-installer prior to 2.0.4.
-
High 7.8CVE-2022-2650 Public exploit
Improper Restriction of Excessive Authentication Attempts in wger-project/wger
Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2.
-
Critical 9.8
An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5…