Improper Restriction of Excessive Authentication Attempts
CWE-307
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
We track 293 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.5.
How this weakness is prevented
- Architecture and Design: Common protection mechanisms include: Disconnecting the user after a small number of failed attempts Implementing a timeout Locking out a targeted account Requiring a computational task on the user's part.
- Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator.
Latest Improper Restriction of Excessive Authentication Attempts vulnerabilities
- 9.4 Critical severity
BiHayat App: Improper Restriction of Excessive Authentication Attempts
Improper restriction of excessive authentication attempts vulnerability in Bahçelievler Muncipality BiHayat App allows Authentication Bypass. This issue affects BiHayat App: from 2.1.7 before 2.3.
- 8.1 High severity
misp: Improper Restriction of Excessive Authentication Attempts
A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. The email_otp() endpoint did not apply brute-force protection when validating submitted OTP va
- 8.5 High severity
FactoryTalk® Activation Manager: Improper Restriction of Excessive Authentication Attempts
A privilege escalation security issue exists within FactoryTalk® Activation Manager. The security issue stems from custom actions in the installer that spawn visible console windows running with SYSTEM privileges during installation or repair operations. An au
- 7.5 High severity
AVideo: Improper Restriction of Excessive Authentication Attempts
WWBN AVideo (current e01e41ecc and earlier) contains a brute-force rate limiting bypass in enforceRateLimit(), which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer (ObjectYPT::setCacheGlobal) that sile
- 7.5 High severity
Ebyte NA111-M Firmware: Improper Restriction of Excessive Authentication Attempts
The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentic
- 9.1 Critical severity
typebot.io: Improper Restriction of Excessive Authentication Attempts
Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the default passwordless email magic-link authentication is vulnerable to login-code brute forcing that leads to account takeover. The email provider overrides NextA
- 8.8 High severity
ransomlook: Improper Restriction of Excessive Authentication Attempts
RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid usernames, perform unrestricted password-guessing attacks, and potentially exhaust application worker resources. For local a
- 7.5 High severity
monkeytype: Authentication Bypass by Spoofing
Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived
- 7.4 High severity
phpMyFAQ: Improper Restriction of Excessive Authentication Attempts
phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each successful password re-authentication. Attackers with a valid password can bypass the five-attempt li
- 7.5 High severity
siyuan: Improper Restriction of Excessive Authentication Attempts
SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service Basic Auth implementation (PublishServiceTransport.RoundTrip() in kernel/server/proxy/publish.go). The Publish Service runs on a separate, unauthenticated-by-d
- 9.8 Critical severity
siyuan: Improper Restriction of Excessive Authentication Attempts
SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth() middleware. The middleware accepts the API token (Conf.Api.Token) via an Authorization header (Token/Bearer) or a ?token=
- 9.8 Critical severity
siyuan: Improper Restriction of Excessive Authentication Attempts
SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/* surface, accepts the workspace access code (Conf.AccessAuthCode) as the Basic
- 7.5 High severity
siyuan: Improper Restriction of Excessive Authentication Attempts
SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows unauthenticated attackers to brute-force per-notebook publish passwords. Attackers can submit unbounded pa
- 9.1 Critical severity
Langflow OSS: Improper Restriction of Excessive Authentication Attempts
IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive authentication attempts.
- 7.3 High severity
Apache Ranger: Improper Restriction of Excessive Authentication Attempts
UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0. Note: UnixAuth is NOT a recommended option for production deployments. Users are recommended to upgrade to version 2.9.0, which fixes this issue.
- 7.4 High severity
appointment-booking-software: Improper Restriction of Excessive Authentication Attempts
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passphrase login attempts. An attacker can submit unlimited wrong passphrase guesses against any known ema
- 7.5 High severity
miniOrange 2FA: Improper Restriction of Excessive Authentication Attempts
The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's pas
- 9.1 Critical severity
typemill: Improper Restriction of Excessive Authentication Attempts
Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-gu
- 8.8 High severity
RouterOS: Improper Restriction of Excessive Authentication Attempts
MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated au
- 8.7 High severity
EZ-P21 IP Camera: Improper Restriction of Excessive Authentication Attempts
This vulnerability exists in CP PLUS EZ-P21 IP Camera due to improper authentication of HTTP endpoints. A remote attacker could exploit this vulnerability by conducting brute-force attacks against HTTP endpoint on the targeted device. Successful exploitation o
- 7.3 High severity
dataCycle-CORE: Improper Restriction of Excessive Authentication Attempts
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimite
- 9.8 Critical severity
yamcs: Improper Restriction of Excessive Authentication Attempts
Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, account lockout, or failed-attempt throttling
- 8.3 High severity
Delphix Continuous Data: Improper Restriction of Excessive Authentication Attempts
A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout threshold to be bypassed through concurrent authentication requests. Parallel login attempts were processed before the failed-login counter and lockout status were
- 7.5 High severity
PasswordPusher: Improper Restriction of Excessive Authentication Attempts
PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a push token can systematically guess passphrases at 120 attempts
- 7.5 High severity
Le Circuit Electrique charging station backend: Improper Restriction of Excessive Authentication Attempts
Previously, there was no throttling on repeated authentication attempts to the charging station backend, which could allow an attacker to execute a denial-of-service attack.
- 7.3 High severity
9router: Improper Restriction of Excessive Authentication Attempts
9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/auth/loginLimiter.js derives the client identity from the attacker-controlled X-Forwarded-For HTTP header, and src/app/api/auth/login/route.js uses that spoofab
- 7.1 High severity
MCO: Improper Restriction of Excessive Authentication Attempts
MCO is vulnerable to Account Denial of Service due to improper implementation of password reset functionality. Each password reset request invalidates previously set password as well as previously issued temporary passwords, furthermore, password resets are no
- 7.5 High severity
EVoke CSMS: Improper Restriction of Excessive Authentication Attempts
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access.
- 9.8 Critical severity
Pause+ Mobile App: Improper Restriction of Excessive Authentication Attempts
Improper restriction of excessive authentication attempts vulnerability in Başbelen Group Food Cafe Businesses Industry and Trade Ltd. Co. Pause+ Mobile App allows Authentication Bypass. This issue affects Pause+ Mobile App: from v1.0.6 before v1.5.
- 7.5 High severity
Nexus Repository Manager: Improper Restriction of Excessive Authentication Attempts
A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints.
- 7.3 High severity
better-auth: Improper Restriction of Excessive Authentication Attempts
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.4.17 and 1.5.0-beta.9, Better Auth's HTTP rate limiter keyed each request by the exact textual IP address it received in x-forwarded-for (or the configured IP-bearing header)
- 8.2 High severity
phpMyFAQ: Improper Restriction of Excessive Authentication Attempts
phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user account password without token verification or email confirmation. Attackers can enumerate valid userna
- 9.8 Critical severity
Login with OTP: Improper Restriction of Excessive Authentication Attempts
The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.6. This is due to an incomplete fix for CVE-2024-11178: the rate-limit/lockout check added to `otpl_login_action()` was placed only inside th
- 9.1 Critical severity
phpmyfaq: Improper Restriction of Excessive Authentication Attempts
phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary user-id parameters without session binding or rate limiting. Unauthenticated attackers can brute-for
- 9.8 Critical severity
vaultwarden: Improper Restriction of Excessive Authentication Attempts
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows bypassing the login brute-force protection if email 2fa is enabled. If email 2fa is enabled, the unprotected 2fa-functio
- 7.5 High severity
signalk-server: Improper Restriction of Excessive Authentication Attempts
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints (POST /login and POST /signalk/v1/auth/login) are protected by express-rate-limit (default: 100 attempts per 10-minute window, confi
- 7.5 High severity
OpenEMR: Improper Restriction of Excessive Authentication Attempts
OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protections by sending repeated login attempts to the main login endpoint. Attackers can submit POST requests with authUser and clearPass parameter
- 7.5 High severity
N300 Firmware: Improper Restriction of Excessive Authentication Attempts
U-SPEED N300 router V1.0.0 does not implement rate limiting or account lockout protections on the /api/login endpoint. This allows an attacker on the local network to perform unlimited authentication attempts, enabling brute-force attacks against the administr
- 7.5 High severity
DWM-222W: Improper Restriction of Excessive Authentication Attempts
DWM-222W USB Wi-Fi Adapter developed by D-Link has a Brute-Force Protection Bypass vulnerability, allowing unauthenticated adjacent network attackers to bypass login attempt limits to perform brute-force attacks to gain control over the device.
- 7.5 High severity
blueprintue-self-hosted-edition: Improper Restriction of Excessive Authentication Attempts
blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the login form handler performs no throttling of any kind. Failed authentication attempts are processed at full network speed with no IP-based rate limiting, no per-account attempt counter