Skip to content
OpenAdvisories

Weakness (CWE)

CWE-307: Improper Restriction of Excessive Authentication Attempts

Base Draft

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

How to prevent it (2 mitigations)

  1. Architecture and Design

    Common protection mechanisms include:

    - Disconnecting the user after a small number of failed attempts

    - Implementing a timeout

    - Locking out a targeted account

    - Requiring a computational task on the user's part.

  2. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].

    Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]

Source: MITRE CWE-307

All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-71205 Public exploit

    changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force

    changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt).

    dgtlmoon changedetection.io
  • Medium 6.9
    CVE-2026-8793 Public exploit

    PaperCut NG/MF: Insufficient brute-force protection

    PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vulnerability to perform unrestricted brute-force or credential-stuffing attacks without triggering acc…

    PaperCut PaperCut NG/MF
  • Medium 6.5
    CVE-2026-44596 Public exploit

    Yamcs: No Rate Limiting on Authentication Endpoint

    Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, account lockout, or failed-attempt throttlin…

    yamcs yamcs org.yamcs:yamcs-core Maven
  • Medium 6.5
    CVE-2025-65427 Public exploit

    An issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version V1.0.0 does not implem…

  • Medium 6.3
    CVE-2025-66204 Public exploit

    WBCE CMS allows brute-force protection bypass using X-Forwarded-For header

    WBCE CMS is a content management system. Version 1.6.4 contains a brute-force protection bypass where an attacker can indefinitely reset the counter by modifying `X-Forwarded-For` on each request, gaining unlimited password guessing attempts, effectively bypa…

    WBCE WBCE_CMS
  • Medium 6.5
    CVE-2025-10658 Public exploit

    SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.7 - Authentication Bypass to Support Session Takeover

    The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.3.7. This is due to missing rate limiting on the OTP verification for guest login. This makes it p…

    psmplugins SupportCandy – Helpdesk & Customer Support Ticket System Web / CMS
  • Medium 5.4
    CVE-2025-52392 Public exploit

    Soosyze CMS's /user/login endpoint missing rate-limiting and lockout mechanisms

    Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can repeatedly submit login attempts without restrictions, potentially gaining unauthorized administrative access. T…

    soosyze/soosyze Packagist
  • Medium 5.4
    CVE-2023-34732 Public exploit

    An issue in the userId parameter in the change password function of Flytxt NEON-dX v0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c …

  • Medium 6.5
    CVE-2024-45589 Public exploit

    RapidIdentity LTS through 2023.0.2 and Cloud through 2024.08.0 improperly restricts excessive authentication attempts a…

  • Medium 6.5
    CVE-2024-32868 Public exploit

    ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass

    ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already gives administrators the option to define a `Lockout Policy` with a maximum amount of failed password ch…

    zitadel zitadel github.com/zitadel/zitadel Go
  • Medium 5.3
    CVE-2023-49792 Public exploit

    Bruteforce protection can be bypassed with misconfigured proxy

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when a…

    Nextcloud security-advisories
  • Medium 5.3
    CVE-2022-30076 Public exploit

    ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student username…