Weakness (CWE)
CWE-645: Overly Restrictive Account Lockout Mechanism
The product contains an account lockout protection mechanism, but the mechanism is too restrictive and can be triggered too easily, which allows attackers to deny service to legitimate users by causing their accounts to be locked out.
How to prevent it (3 mitigations)
-
Architecture and Design
Implement more intelligent password throttling mechanisms such as those that take IP address into account, in addition to the login name.
-
Architecture and Design
Implement a lockout timeout that grows as the number of incorrect login attempts goes up, eventually resulting in a complete lockout.
-
Architecture and Design
Consider alternatives to account lockout that would still be effective against password brute force attacks, such as presenting the user machine with a puzzle to solve (making it do some computation).
Source: MITRE CWE-645
9 results · Feed
-
Medium 5.3
Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Overly Restrictive Account Lockout Mechanism vulne…
-
Medium 6.9
Payload: Unauthenticated account-lockout denial of service
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account lockout mechanism of a…
-
Medium 6.5
Cap-go Console < 12.28.2 Account Deletion DoS via Device Identifier Association
Cap-go Console < 12.28.2 contains a denial-of-service vulnerability in its account deletion flow that allows an attacker to block authentication and onboarding functions by triggering account deletion while a device identifier is linked to the active session.…
-
Medium 5.3
Dell PowerScale OneFS, version 9.13.0.0, contains an overly restrictive account lockout mechanism vulnerability. An una…
-
Medium 5.3
Denial-of-Service Vulnerability in MELSEC iQ-F Series
Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series allows a remote unauthenticated attacker to lockout legitimate users for a certain period by repeatedly attempting to login with incorrect passwor…
-
Medium 5.8
Repeated LDAP login failures can lock an LDAP account
Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost.
-
Medium 5.3
BIG-IP Next Central Manager vulnerability
BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
-
Low 3.7
Keycloak-core: dos via account lockout
A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in.
-
High 7.5CVE-2023-4346 Exploited
KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable…
KEV Jul 15, 2026