Description
By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see https://docs.azul.com/payara/technical-documentation/payara-server-documentation/security-guide/administering-system-security.html .
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Payara | Payara Server | 7.0.0 – < 7.2.0, 7.2025.1 – < 7.2026.7, 6.0.0 – < 6.40.0, 5.20.0 – < 5.89.0, 4.1.144 – < 4.1.2.191.57, 6.2023.1, 5.2020.1 | 7.2.0 |
References
- https://docs.azul.com/payara/release-notes/release-notes-7.2.0.html release-notes
- https://docs.azul.com/payara/version/6/release-notes/release-notes-6.40.0.html release-notes
- https://docs.azul.com/payara/version/5/release-notes/release-notes-5.89.0.html release-notes
- https://docs.azul.com/payara/version/4/release-notes/release-notes-4.1.2.191.57.html release-notes
- https://docs.azul.com/payara-community/release-notes/release-notes-7.2026.7.html release-notes