Weakness (CWE)
CWE-307: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
How to prevent it (2 mitigations)
-
Architecture and Design
Common protection mechanisms include:
- Disconnecting the user after a small number of failed attempts
- Implementing a timeout
- Locking out a targeted account
- Requiring a computational task on the user's part.
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]
Source: MITRE CWE-307
570 results · Feed
-
High 7.5
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains…
-
High 7.4
WWBN AVideo Unrestricted Authentication Attempts via get_api_preauthorize
WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_api_preauthorize in plugin/API/API.php as a second, undocumented login path. Unlike get_api_signIn, which enforces a rate limit of 10 attempts per 5 minutes via checkRateLimit(), …
-
Critical 9.4
OTP Bypass in Bahçelievler Muncipality's BiHayat App
Improper restriction of excessive authentication attempts vulnerability in Bahçelievler Muncipality BiHayat App allows Authentication Bypass. This issue affects BiHayat App: from 2.1.7 before 2.3.
-
Medium 4.4
In Audio HAL, there is a possible information disclosure due to a missing permission check. This could lead to local in…
-
Medium 6.7
In Audio HAL, there is a possible escalation of privilege due to improper input validation. This could lead to local es…
-
Medium 6.5
AVideo API Rate Limit Bypass via Bot User-Agent Header
AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can send requests with a bot User-Agent to disable rate limiting a…
-
High 8.6
Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass
A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. The email_otp() endpoint did not apply brute-force protection when validating submitted OTP v…
-
Medium 6.9
CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to…
-
High 8.5
Rockwell Automation FactoryTalk® Activation Manager - Privilege Escalation
A privilege escalation security issue exists within FactoryTalk® Activation Manager. The security issue stems from custom actions in the installer that spawn visible console windows running with SYSTEM privileges during installation or repair operations. An a…
-
High 7.5
WWBN AVideo Brute-force Rate Limiting Bypass via Missing User-Agent
WWBN AVideo (current e01e41ecc and earlier) contains a brute-force rate limiting bypass in enforceRateLimit(), which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer (ObjectYPT::setCacheGlobal) that sil…
-
Medium 6.5
WWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php
WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor co…
-
Medium 6.3
WatchGuard Dimension Web UI Authentication Brute-Force Due to Missing Rate Limiting
WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user accounts. If the account lockout setting is enabled, brute-force at…
-
High 7.5
Ebyte NA111-M Improper Restriction of Excessive Authentication Attempts
The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authenti…
-
Medium 5.7
Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.
-
Critical 9.1
TypeBot: Account takeover via brute-forceable 6-digit magic-link code
Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the default passwordless email magic-link authentication is vulnerable to login-code brute forcing that leads to account takeover. The email provider overrides Next…
-
Critical 9.1
Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session
Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session. The POST handler on challenge_path keeps the failure count as…
-
Medium 5.3
Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method
Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEm…
-
High 8.8
RansomLook Login Endpoint Allows Timing-Based Username Enumeration and Unthrottled Authentication Attempts
RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid usernames, perform unrestricted password-guessing attacks, and potentially exhaust application worker resources. For local …
-
Medium 5.3
HCL Hive is affected by a missing rate limit
HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service.
-
High 7.5
Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)
Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived…
-
High 7.4
phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle
phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each successful password re-authentication. Attackers with a valid password can bypass the five-attempt l…
-
Medium 5.3
Plainpad Missing Rate Limiting via POST /v1/sessions
Plainpad through 1.1.1, fixed in commit d3823fc, contains a missing rate limiting vulnerability that allows unauthenticated attackers to send unbounded login requests to the POST /v1/sessions endpoint due to dead code in App\Http\Kernel.php that is never inst…
-
Low 3.7
karakeep-app karakeep Login Endpoint auth.ts authorize excessive authentication
A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication a…
-
High 7.5
SiYuan before 3.7.4 Brute-Force Authentication via Publish Service
SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service Basic Auth implementation (PublishServiceTransport.RoundTrip() in kernel/server/proxy/publish.go). The Publish Service runs on a separate, unauthenticated-by-…
-
Critical 9.8
SiYuan kernel before 3.7.4 Unthrottled Brute-Force via API Token
SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth() middleware. The middleware accepts the API token (Conf.Api.Token) via an Authorization header (Token/Bearer) or a ?token=…
-
Critical 9.8
SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Auth
SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/* surface, accepts the workspace access code (Conf.AccessAuthCode) as the Basi…
-
High 7.5
SiYuan before 3.7.4 Brute-Force via authFilePublishAccess
SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows unauthenticated attackers to brute-force per-notebook publish passwords. Attackers can submit unbounded p…
-
Low 3.7
VictoriaMetrics VMAuth Authentication Endpoint main.go requestHandler excessive authentication
A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authenti…
-
Low 3.7
mangroup dtale Login Endpoint auth.py login excessive authentication
A vulnerability has been found in mangroup dtale up to 3.22.0. This issue affects the function Login of the file dtale/auth.py of the component Login Endpoint. Such manipulation leads to improper restriction of excessive authentication attempts. The attack ca…
-
Low 3.7
opensourcepos Open Source Point of Sale Login Endpoint Filters.php index excessive authentication
A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php of the component Login Endpoint. The manipulation results in improper restriction of excessive authe…
-
Critical 9.1
Insufficient Authentication Brute Force Protection on Login Endpoint
IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive authentication attempts.
-
Medium 5.6
HCL AION is affected by multiple security vulnerabilities.
HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted without adequate rate limiting or challenge mechanisms, potentially resulting in unintended behavior or s…
-
Medium 5.3
Mira Hormone Monitor, Mira Android App Improper restriction of excessive authentication attempts
The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. An attacker can use brute-force methods to obtain gain access to user accounts.
-
High 7.3
Apache Ranger: UnixAuth lacks brute-force protection
UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0. Note: UnixAuth is NOT a recommended option for production deployments. Users are recommended to upgrade to version 2.9.0, which fixes this issue.
-
High 7.4
OpenReception doesn't rate limit passphrase login attempts
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passphrase login attempts. An attacker can submit unlimited wrong passphrase guesses against any known em…
-
Medium 5.8
OpenReception's client PIN challenge throttle is keyed by emailHash only, allowing cross-tenant lockout
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the PIN-type challenge throttle uses `emailHash` as the only key. The throttle rows live in the central `challenge_throttle` ta…
-
High 7.5
miniOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor Attempts
The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's pa…
-
Critical 9.1
typemill - No Rate Limiting on Login Endpoint Enables Unlimited Password Brute-Force
Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-g…
-
Medium 6.5CVE-2026-71205 Public exploit
changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force
changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt).
-
Medium 6.9CVE-2026-8793 Public exploit
PaperCut NG/MF: Insufficient brute-force protection
PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vulnerability to perform unrestricted brute-force or credential-stuffing attacks without triggering acc…