Weakness (CWE)

CWE-307: Improper Restriction of Excessive Authentication Attempts

Base Draft

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

How to prevent it (2 mitigations)

Architecture and Design

Common protection mechanisms include:
- Disconnecting the user after a small number of failed attempts
- Implementing a timeout
- Locking out a targeted account
- Requiring a computational task on the user's part.
Architecture and Design

Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]

Source: MITRE CWE-307

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

Low 3.7

CVE-2026-7671 Public exploit

CodeWise Tornet Scooter Mobile App TwoFactor excessive authentication

A vulnerability has been found in CodeWise Tornet Scooter Mobile App 4.75 on iOS/Android. The impacted element is an unknown function of the file /TwoFactor. Such manipulation leads to improper restriction of excessive authentication attempts. The attack may …

CodeWise Tornet Scooter Mobile App

May 2, 2026
Low 3.5

CVE-2023-26209 Public exploit

A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiDeceptor 3.1.x and…

Fortinet FortiDeceptor Network devices

Mar 9, 2023
Low 3.5

CVE-2023-26208 Public exploit

A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiAuthenticator 6.4.…

Fortinet FortiAuthenticator Network devices

Mar 9, 2023
Low 3.5

CVE-2022-29056 Public exploit

A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiMail version 6.4.0…

Fortinet FortiMail Network devices

Mar 9, 2023