Improper Restriction of Excessive Authentication Attempts
CWE-307
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
We track 293 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.5.
How this weakness is prevented
- Architecture and Design: Common protection mechanisms include: Disconnecting the user after a small number of failed attempts Implementing a timeout Locking out a targeted account Requiring a computational task on the user's part.
- Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator.
Latest Improper Restriction of Excessive Authentication Attempts vulnerabilities
- 9.8 Critical severity
RAGFlow: Improper Restriction of Excessive Authentication Attempts
RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and password reset. Codes are six digits and there is no rate lim
- 9.8 Critical severity
Agentflow: Improper Restriction of Excessive Authentication Attempts
Agentflow from Flowring Technology has an Account Lockout Bypass vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to perform password brute force attack.
- 8.2 High severity
KYC solutions: Improper Restriction of Excessive Authentication Attempts
This vulnerability exists in Meon KYC solutions due to missing restrictions on the number of incorrect One-Time Password (OTP) attempts through certain API endpoints of login process. A remote attacker could exploit this vulnerability by performing a brute for
- 8.1 High severity
eCommerce-website-in-PHP: Improper Restriction of Excessive Authentication Attempts
A vulnerability classified as problematic was found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected by this vulnerability is an unknown functionality of the file /admin/login.php. The manipulation leads to improper restriction of excessive authenticat
- 8.1 High severity
eCommerce-website-in-PHP: Improper Restriction of Excessive Authentication Attempts
A vulnerability classified as problematic has been found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected is an unknown function of the file /login.php. The manipulation leads to improper restriction of excessive authentication attempts. It is possible
- 7.0 High severity
Valmet DNA: Improper Restriction of Excessive Authentication Attempts
Lack of protection against brute force attacks in Valmet DNA visualization in DNA Operate. The possibility to make an arbitrary number of login attempts without any rate limit gives an attacker an increased chance of guessing passwords and then performing swit
- 8.1 High severity
langgenius/dify: Improper Restriction of Excessive Authentication Attempts
langgenius/dify version v0.10.1 contains a vulnerability where there are no limits applied to the number of code guess attempts for password reset. This allows an unauthenticated attacker to reset owner, admin, or other user passwords within a few hours by gue
- 8.0 High severity
HCL MyXalytics: Improper Restriction of Excessive Authentication Attempts
HCL MyXalytics is affected by concurrent login vulnerability. A concurrent login vulnerability occurs when simultaneous active sessions are allowed for a single credential allowing an attacker to potentially obtain access to a user's account or sensitive infor
- 8.1 High severity
Red Hat JBoss Enterprise Application Platform…: Improper Restriction of Excessive Authentication Attempts
A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.
- 7.5 High severity
Sylius: Improper Restriction of Excessive Authentication Attempts
A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk of account compromise and denial of service for legitimate users. The Supplier's position is that th
- 9.8 Critical severity
FortiClientEMS: Improper Restriction of Excessive Authentication Attempts
An improper restriction of excessive authentication attempts [CWE-307] in FortiClientEMS version 7.2.0 through 7.2.4 and before 7.0.10 allows an unauthenticated attacker to try a brute force attack against the FortiClientEMS console via crafted HTTP or HTTPS r
- 7.5 High severity
Jatos: Improper Restriction of Excessive Authentication Attempts
JATOS 3.9.4 contains a denial-of-service (DoS) vulnerability in the authentication system, where an attacker can prevent legitimate users from accessing their accounts by repeatedly sending multiple failed login attempts. Specifically, by submitting 3 incorrec
- 8.2 High severity
Trend Micro ID Security: Allocation of Resources Without Limits or Throttling
Trend Micro ID Security, version 3.0 and below contains a vulnerability that could allow an attacker to send an unlimited number of email verification requests without any restriction, potentially leading to abuse or denial of service.
- 9.8 Critical severity
RecoverPoint for Virtual Machines: Improper Restriction of Excessive Authentication Attempts
Dell RecoverPoint for Virtual Machines 6.0.x contains a vulnerability. An improper Restriction of Excessive Authentication vulnerability where a Network attacker could potentially exploit this vulnerability, leading to a brute force attack or a dictionary atta
- 8.1 High severity
opencti: Improper Restriction of Excessive Authentication Attempts
OpenCTI is an open-source cyber threat intelligence platform. In versions below 6.2.18, because the function to limit the rate of OTP does not exist, an attacker with valid credentials or a malicious user who commits internal fraud can break through the two-fa
- 7.2 High severity
Wyse Management Suite: Improper Restriction of Excessive Authentication Attempts
Dell Wyse Management Suite, versions WMS 4.4 and prior, contain an Improper Restriction of Excessive Authentication Attempts vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechan
- 9.8 Critical severity
Unified SecOps Platform: Improper Restriction of Excessive Authentication Attempts
Logsign Unified SecOps Platform Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Logsign Unified SecOps Platform. Authentication is not required to exploit this vulnerability.
- 9.3 Critical severity
Life2000 Ventilation System: Improper Restriction of Excessive Authentication Attempts
There is no limit on the number of failed login attempts permitted with the Clinician Password or the Serial Number Clinician Password. An attacker could execute a brute-force attack to gain unauthorized access to the ventilator, and then make changes to devic
- 9.8 Critical severity
Wave 2.0: Improper Restriction of Excessive Authentication Attempts
This vulnerability exists in the Wave 2.0 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user OTP, MPIN o
- 9.1 Critical severity
multi-channel_integrated_pos: Improper Restriction of Excessive Authentication Attempts
A lack of rate limiting in the OTP validation component of Digitory Multi Channel Integrated POS v1.0 allows attackers to gain access to the ordering system and place an excessive amount of food orders.
- 8.8 High severity
Telerik Report Server: Improper Restriction of Excessive Authentication Attempts
In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a credential stuffing attack is possible through improper restriction of excessive login attempts.
- 9.8 Critical severity
Client Dashboard: Improper Restriction of Excessive Authentication Attempts
This vulnerability exists in Shilpi Client Dashboard due to missing restrictions for incorrect login attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack on password, which could lead to gain un
- 9.8 Critical severity
kaiten: Improper Restriction of Excessive Authentication Attempts
A vulnerability in Kaiten version 57.131.12 and earlier allows attackers to bypass the PIN code authentication mechanism. The application requires users to input a 6-digit PIN code sent to their email for authorization after entering their login credentials. H
- 9.8 Critical severity
LD Geo: Improper Restriction of Excessive Authentication Attempts
This vulnerability exists in Apex Softcell LD Geo due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack on login OTP, which could l
- 9.1 Critical severity
id_bravura_security_fabric: Improper Restriction of Excessive Authentication Attempts
An issue was discovered in Bravura Security Fabric versions 12.3.x before 12.3.5.32784, 12.4.x before 12.4.3.35110, 12.5.x before 12.5.2.35950, 12.6.x before 12.6.2.37183, and 12.7.x before 12.7.1.38241. An unauthenticated attacker can cause a resource leak by
- 9.8 Critical severity
Mutual Fund Distribution Product (aiM-Star): Improper Restriction of Excessive Authentication Attempts
This vulnerability exists in Reedos aiM-Star version 2.0.1 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate
- 7.5 High severity
FortiSOAR: Improper Restriction of Excessive Authentication Attempts
An improper authorization vulnerability [CWE-285] in FortiSOAR version 7.4.0 through 7.4.3, 7.3.0 through 7.3.2, 7.2.0 through 7.2.2, 7.0.0 through 7.0.3 change password endpoint may allow an authenticated attacker to perform a brute force attack on users and
- 9.8 Critical severity
upKeeper Manager: Improper Restriction of Excessive Authentication Attempts
Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue affects upKeeper Manager: through 5.1.9.
- 9.8 Critical severity
upKeeper Manager: Improper Restriction of Excessive Authentication Attempts
Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue affects upKeeper Manager: through 5.1.9.
- 7.4 High severity
Adobe Commerce: Improper Restriction of Excessive Authentication Attempts
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability t
- 7.5 High severity
SINEC Traffic Analyzer: Improper Restriction of Excessive Authentication Attempts
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application do not properly enforce restriction of excessive authentication attempts. This could allow an unauthenticated attacker to conduct
- 9.8 Critical severity
mt6000_firmware: Improper Restriction of Excessive Authentication Attempts
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a remote code execu
- 9.8 Critical severity
xrdp: Improper Restriction of Excessive Authentication Attempts
xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be limited by a configuration parameter `MaxLoginRetry` in
- 7.5 High severity
SINEMA Remote Connect Server: Improper Restriction of Excessive Authentication Attempts
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly implement brute force protection against user credentials in its Client Communication component. This could allow an attac
- 7.5 High severity
SINEMA Remote Connect Server: Improper Restriction of Excessive Authentication Attempts
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly implement brute force protection against user credentials in its web API. This could allow an attacker to learn user crede
- 7.5 High severity
Mia-Med Health Aplication: Improper Restriction of Excessive Authentication Attempts
Improper Restriction of Excessive Authentication Attempts vulnerability in Mia Technology Inc. Mia-Med Health Aplication allows Interface Manipulation. This issue affects Mia-Med Health Aplication: before 1.0.14.
- 7.5 High severity
Checkmk: Improper Restriction of Excessive Authentication Attempts
Improper restriction of excessive authentication attempts with two factor authentication methods in Checkmk 2.3 before 2.3.0p6 facilitates brute-forcing of second factor mechanisms.
- 8.8 High severity
ProfileGrid: Improper Restriction of Excessive Authentication Attempts
Improper Restriction of Excessive Authentication Attempts vulnerability in Metagauss ProfileGrid allows Removing Important Client Functionality.This issue affects ProfileGrid : from n/a through 5.8.2.
- 8.1 High severity
zitadel: Improper Restriction of Excessive Authentication Attempts
ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already gives administrators the option to define a `Lockout Policy` with a maximum amount of failed password che
- 9.8 Critical severity
Checkmk: Improper Restriction of Excessive Authentication Attempts
Improper restriction of excessive authentication attempts on some authentication methods in Checkmk before 2.3.0b5 (beta), 2.2.0p26, 2.1.0p43, and in Checkmk 2.0.0 (EOL) facilitates password brute-forcing.