Improper Restriction of Excessive Authentication Attempts
CWE-307
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
We track 293 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.5.
How this weakness is prevented
- Architecture and Design: Common protection mechanisms include: Disconnecting the user after a small number of failed attempts Implementing a timeout Locking out a targeted account Requiring a computational task on the user's part.
- Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator.
Latest Improper Restriction of Excessive Authentication Attempts vulnerabilities
- 7.5 High severity
CloudBoost Virtual Appliance: Improper Restriction of Excessive Authentication Attempts
Dell CloudBoost Virtual Appliance, versions 19.13.0.0 and prior, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauth
- 9.8 Critical severity
CareLink Network: Improper Restriction of Excessive Authentication Attempts
Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint that could be used to determine a valid password under certain circumstances. This issue affects CareLink Network: before December 4, 2025.
- 9.8 Critical severity
EPSON WebConfig for SEIKO EPSON Projector…: Improper Restriction of Excessive Authentication Attempts
EPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products do not restrict excessive authentication attempts. An administrative user's password may be identified through a brute force attack.
- 9.8 Critical severity
Blogin: Improper Restriction of Excessive Authentication Attempts
An issue was discovered in weijiang1994 university-bbs (aka Blogin) in commit 9e06bab430bfc729f27b4284ba7570db3b11ce84 (2025-01-13). A weak verification code generation mechanism combined with missing rate limiting allows attackers to perform brute-force attac
- 7.5 High severity
Windu CMS: Improper Restriction of Excessive Authentication Attempts
Windu CMS implements weak client-side brute-force protection by using parameter loginError. Information about attempt count or timeout is not stored on the server, which allows a malicious attacker to bypass this brute-force protection by resetting this parame
- 7.3 High severity
Perfektive: Improper Restriction of Excessive Authentication Attempts
Improper Restriction of Excessive Authentication Attempts, Client-Side Enforcement of Server-Side Security, Reliance on Untrusted Inputs in a Security Decision vulnerability in Turkguven Software Technologies Inc. Perfektive allows Brute Force, Authentication
- 8.1 High severity
Community Edition: Improper Restriction of Excessive Authentication Attempts
A vulnerability was identified in LogicalDOC Community Edition up to 9.2.1. This vulnerability affects unknown code of the file /login.jsp of the component Admin Login Page. Such manipulation leads to improper restriction of excessive authentication attempts.
- 9.8 Critical severity
zitadel: Improper Restriction of Excessive Authentication Attempts
Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, an attacker can perform an online brute-force attack on OTP, TOTP, and passwords. While Zitadel allows preventing online brute force attacks in scenarios like TOTP, Em
- 7.6 High severity
Fusion: Improper Authentication
A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication via a bruteforce attack.
- 7.5 High severity
Moodle: Improper Restriction of Excessive Authentication Attempts
Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks.
- 8.1 High severity
Signinghub: Improper Restriction of Excessive Authentication Attempts
A lack of rate limiting in the One-Time Password (OTP) verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification via a bruteforce attack.
- 9.8 Critical severity
Baggage Analytics: Improper Restriction of Excessive Authentication Attempts
The application does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it possible for an attacker to guess user credentials.
- 9.8 Critical severity
ExtremeGuest Essentials: Improper Restriction of Excessive Authentication Attempts
In ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure. Under certain ExtremeGuest Essentials captive-portal SSID configurations, repeated manual login attempts may allow an unauthenticated devi
- 7.5 High severity
Acropolis: Improper Restriction of Excessive Authentication Attempts
Airship AI Acropolis allows unlimited MFA attempts for 15 minutes after a user has logged in with valid credentials. A remote attacker with valid credentials could brute-force the 6-digit MFA code. Fixed in 10.2.35, 11.0.21, and 11.1.9.
- 7.7 High severity
In-Sight 2000 series: Improper Restriction of Excessive Authentication Attempts
Cognex In-Sight Explorer and In-Sight Camera Firmware expose a telnet-based service on port 23 in order to allow management operations on the device such as firmware upgrades and device reboot requiring an authentication. A wrong management of login failures o
- 8.6 High severity
e-Mutabakat: Improper Restriction of Excessive Authentication Attempts
Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft e-Mutabakat allows Authentication Bypass. This issue affects e-Mutabakat: from 2.02.06 before v2.02.06.
- 8.6 High severity
TaskPano: Improper Restriction of Excessive Authentication Attempts
Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft TaskPano allows Authentication Bypass. This issue affects TaskPano: from s1.06.04 before v1.06.06.
- 8.6 High severity
LimonDesk: Improper Restriction of Excessive Authentication Attempts
Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft LimonDesk allows Authentication Bypass. This issue affects LimonDesk: from s1.02.14 before v1.02.17.
- 8.6 High severity
MyRezzta: Improper Restriction of Excessive Authentication Attempts
Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypass. This issue affects MyRezzta: from s2.03.01 before v2.05.01.
- 9.8 Critical severity
MyRezzta: Improper Restriction of Excessive Authentication Attempts
Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypass, Password Recovery Exploitation, Brute Force. This issue affects MyRezzta: from s2.03.01 before v2.05.01.
- 8.6 High severity
ProKuafor: Improper Restriction of Excessive Authentication Attempts
Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft ProKuafor allows Authentication Bypass. This issue affects ProKuafor: from s1.02.08 before v1.02.08.
- 8.6 High severity
OctoCloud: Improper Restriction of Excessive Authentication Attempts
Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft OctoCloud allows Authentication Bypass. This issue affects OctoCloud: from s1.09.03 before v1.11.01.
- 8.6 High severity
QR Menu: Improper Restriction of Excessive Authentication Attempts
Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft QR Menu allows Authentication Bypass. This issue affects QR Menu: from s1.05.07 before v1.05.12.
- 9.1 Critical severity
mblog: Improper Restriction of Excessive Authentication Attempts
A vulnerability was found in mtons mblog up to 3.5.0. This issue affects some unknown processing of the file /settings/password. The manipulation leads to improper restriction of excessive authentication attempts. The attack may be initiated remotely. The comp
- 8.1 High severity
EG4 12kPV: Improper Restriction of Excessive Authentication Attempts
The affected product does not limit the number of attempts for inputting the correct PIN for a registered product, which may allow an attacker to gain unauthorized access using brute-force methods if they possess a valid device serial number. The API provides
- 7.5 High severity
Trilium: Improper Restriction of Excessive Authentication Attempts
Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. In versions below 0.97.0, a brute-force protection bypass in the initial sync seed retrieval endpoint allows unauthentic
- 7.5 High severity
FOIAXpress Public Access Link (PAL): Improper Restriction of Excessive Authentication Attempts
OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows attackers to bypass account-lockout and CAPTCHA protections. Unauthenticated remote attackers can more easily brute force passwords.
- 7.5 High severity
Informix Dynamic Server: Improper Restriction of Excessive Authentication Attempts
IBM Informix Dynamic Server 12.10 and 14.10 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.
- 9.8 Critical severity
Mail Login: Improper Restriction of Excessive Authentication Attempts
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 before 3.2.0, from 4.0.0 before 4.2.0.
- 9.8 Critical severity
Eclipse Glassfish: Improper Restriction of Excessive Authentication Attempts
In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts. GlassFish 8.0.3 adds automatic attack protection documented in https://glassfish.org/docs/latest/se
- 9.8 Critical severity
Endress+Hauser MEAC300-FNADE4: Improper Restriction of Excessive Authentication Attempts
The SMB server's login mechanism does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks.
- 9.8 Critical severity
Endress+Hauser MEAC300-FNADE4: Improper Restriction of Excessive Authentication Attempts
The MEAC300-FNADE4 does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks.
- 9.8 Critical severity
Endress+Hauser MEAC300-FNADE4: Improper Restriction of Excessive Authentication Attempts
The maxView Storage Manager does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks.
- 7.5 High severity
filebrowser: Improper Restriction of Excessive Authentication Attempts
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the authentication process in
- 9.3 Critical severity
Wi-Fi Cloud Hotspot: Improper Restriction of Excessive Authentication Attempts
Improper Restriction of Excessive Authentication Attempts vulnerability in Art-in Bilişim Teknolojileri ve Yazılım Hizm. Tic. Ltd. Şti. Wi-Fi Cloud Hotspot allows Authentication Abuse, Authentication Bypass. This issue affects Wi-Fi Cloud Hotspot: before 30.05
- 7.8 High severity
Controller: Improper Restriction of Excessive Authentication Attempts
Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute force guess the 6-digit password reset PIN
- 9.4 Critical severity
Cyclone Matrix TRF: Authentication Bypass by Capture-replay
Use of fixed learning codes, one code to lock the car and the other code to unlock it, in the Key Fob Transmitter in Cyclone Matrix TRF Smart Keyless Entry System, which allows a replay attack. Research was completed on the 2024 KIA Soluto. Attack confirmed on
- 9.4 Critical severity
Aftermarket Generic Smart Keyless Entry System: Authentication Bypass by Capture-replay
Use of fixed learning codes, one code to lock the car and the other code to unlock it, the Key Fob Transmitter in KIA-branded Aftermarket Generic Smart Keyless Entry System, primarily distributed in Ecuador, which allows a replay attack. Manufacture is unknown
- 9.8 Critical severity
vantage6: Improper Restriction of Excessive Authentication Attempts
vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. If attacker gets access to an authenticated session, they can try to brute-force the user password by us
- 9.8 Critical severity
SICK Media Server: Improper Restriction of Excessive Authentication Attempts
The FTP server’s login mechanism does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potentially compromising the FTP server.