Improper Restriction of Excessive Authentication Attempts
CWE-307
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
We track 293 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.5.
How this weakness is prevented
- Architecture and Design: Common protection mechanisms include: Disconnecting the user after a small number of failed attempts Implementing a timeout Locking out a targeted account Requiring a computational task on the user's part.
- Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator.
Latest Improper Restriction of Excessive Authentication Attempts vulnerabilities
- 9.1 Critical severity
argo-cd: Improper Restriction of Excessive Authentication Attempts
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effectively bypass the rate limit and brute force protections by exploiting the application's weak cache-based mechanism. Thi
- 9.8 Critical severity
argo-cd: Improper Restriction of Excessive Authentication Attempts
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can exploit a chain of vulnerabilities, including a Denial of Service (DoS) flaw and in-memory data storage weakness, to effectiv
- 9.8 Critical severity
Easergy T200 (Modbus) Models: T200I, T200E…: Improper Restriction of Excessive Authentication Attempts
CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover and unauthorized access to the system when an attacker conducts brute-force attacks against the login form.
- 9.8 Critical severity
CasaOS-UserService: Improper Restriction of Excessive Authentication Attempts
CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn't defend against password brute force attacks, which leads to having full access to the server. The web application lack
- 9.8 Critical severity
RecoverPoint for VMs: Improper Restriction of Excessive Authentication Attempts
Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains a brute force/dictionary attack vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to launch a brute force attack or a dictionary attack against
- 7.5 High severity
Engineering Lifecycle Optimization - Publishing: Improper Restriction of Excessive Authentication Attempts
IBM Engineering Lifecycle Optimization 7.0.2 and 7.0.3 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 268755.
- 7.5 High severity
Cloud Pak System: Improper Restriction of Excessive Authentication Attempts
IBM Cloud Pak System 2.3.1.1, 2.3.2.0, and 2.3.3.7 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 260733.
- 7.5 High severity
PowerSC: Improper Restriction of Excessive Authentication Attempts
IBM PowerSC 1.3, 2.0, and 2.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 275107.
- 9.8 Critical severity
Maximiser Soft Pbx: Improper Restriction of Excessive Authentication Attempts
SpliceCom Maximiser Soft PBX v1.5 and before does not restrict excessive authentication attempts, allowing attackers to bypass authentication via a brute force attack.
- 9.1 Critical severity
CJ-series and CS-series CPU modules: Improper Restriction of Excessive Authentication Attempts
The Omron FINS protocol has an authenticated feature to prevent access to memory regions. Authentication is susceptible to bruteforce attack, which may allow an adversary to gain access to protected memory. This access can allow overwrite of values including p
- 9.1 Critical severity
App Connect Enterprise: Improper Restriction of Excessive Authentication Attempts
IBM App Connect Enterprise 11.0.0.1 through 11.0.0.24 and 12.0.1.0 through 12.0.11.0 could allow a remote attacker to obtain sensitive information or cause a denial of service due to improper restriction of excessive authentication attempts. IBM X-Force ID: 27
- 8.1 High severity
Alarm System: Improper Restriction of Excessive Authentication Attempts
The number of attempts to bring the Hozard Alarm system (alarmsystemen) v1.0 to a disarmed state is not limited. This could allow an attacker to perform a brute force on the SMS authentication, to bring the alarm system to a disarmed state.
- 9.8 Critical severity
security-advisories: Improper Restriction of Excessive Authentication Attempts
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when a
- 9.8 Critical severity
M-Files Server: Improper Restriction of Excessive Authentication Attempts
Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authentication attempts, potentially compromising targeted M-Files user accounts by guessing passwords.
- 9.1 Critical severity
Write-back Manager: Improper Restriction of Excessive Authentication Attempts
Xpand IT Write-back Manager v2.3.1 uses weak secret keys to sign JWT tokens. This allows attackers to easily obtain the secret key used to sign JWT tokens via a bruteforce attack.
- 9.8 Critical severity
ETL3100: Improper Restriction of Excessive Authentication Attempts
EuroTel ETL3100 versions v01c01 and v01x37 does not limit the number of attempts to guess administrative credentials in remote password attacks to gain full control of the system.
- 9.8 Critical severity
tml-2fa: Improper Restriction of Excessive Authentication Attempts
The Theme My Login 2FA WordPress plugin before 1.2 does not rate limit 2FA validation attempts, which may allow an attacker to brute-force all possibilities, which shouldn't be too long, as the 2FA codes are 6 digits.
- 7.5 High severity
Zed!: Improper Restriction of Excessive Authentication Attempts
By default, .ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI qualification submission); ZED! for Windows before Q.2021.2 (ANSSI qualification submission); ZONECENTRAL for Windows before Q.2021.2 (ANSSI qualification submission); ZONECE
- 9.8 Critical severity
IceCMS: Improper Restriction of Excessive Authentication Attempts
A vulnerability was found in Thecosy IceCMS 2.0.1. It has been classified as problematic. Affected is an unknown function of the file /login of the component Captcha Handler. The manipulation leads to improper restriction of excessive authentication attempts.
- 9.8 Critical severity
Doracms: Improper Restriction of Excessive Authentication Attempts
DoraCMS v2.1.8 was discovered to re-use the same code for verification of valid usernames and passwords. This vulnerability allows attackers to gain access to the application via a bruteforce attack.
- 9.8 Critical severity
Password Reset with Code for WordPress REST API: Improper Restriction of Excessive Authentication Attempts
Improper Restriction of Excessive Authentication Attempts vulnerability in Be Devious Web Development Password Reset with Code for WordPress REST API allows Authentication Abuse.This issue affects Password Reset with Code for WordPress REST API: from n/a throu
- 9.8 Critical severity
ac21000_g6_firmware: Improper Restriction of Excessive Authentication Attempts
A client side rate limit issue discovered in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain escalated privileges via brute force style attacks.
- 9.8 Critical severity
Kodbox: Improper Restriction of Excessive Authentication Attempts
kodbox 1.46.01 has a security flaw that enables user enumeration. This problem is present on the login page, where an attacker can identify valid users based on varying response messages, potentially paving the way for a brute force attack.
- 7.5 High severity
librenms: Improper Restriction of Excessive Authentication Attempts
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions the login method has no rate limit. An attacker may be able to leverage this vulnera
- 7.3 High severity
FortiMail: Improper Restriction of Excessive Authentication Attempts
An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiMail webmail version 7.2.0 through 7.2.4, 7.0.0 through 7.0.6 and before 6.4.8 may allow an unauthenticated attacker to perform a brute force attack on the affected en
- 9.8 Critical severity
NOKIA G-040W-Q: Improper Restriction of Excessive Authentication Attempts
Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of insufficient measures to prevent multiple failed authentication attempts. An unauthenticated remote attacker can execute a crafted Javascript to expose captcha in page, making it very easy for bots to bypa
- 7.5 High severity
etg150_fm: Improper Restriction of Excessive Authentication Attempts
A lack of rate limiting in Elenos ETG150 FM transmitter v3.12 allows attackers to obtain user credentials via brute force and cause other unspecified impacts.
- 9.8 Critical severity
PolyEco1000: Improper Restriction of Excessive Authentication Attempts
Sielco PolyEco1000 uses a weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system.
- 9.8 Critical severity
Analog FM transmitter: Improper Restriction of Excessive Authentication Attempts
The cookie session ID is of insufficient length and can be exploited by brute force, which may allow a remote attacker to obtain a valid session, bypass authentication, and manipulate the transmitter.
- 7.5 High severity
TETRA Standard: Improper Restriction of Excessive Authentication Attempts
The TETRA TEA1 keystream generator implements a key register initialization function that compresses the 80-bit key to only 32 bits for usage during the keystream generation phase, which is insufficient to safeguard against exhaustive search attacks.
- 7.5 High severity
security-advisories: Improper Restriction of Excessive Authentication Attempts
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server starting with 22.0.0 and prior to 22.2.10.14, 23.0.12.9, 24.0.12.
- 7.5 High severity
HarmonyOS: Improper Restriction of Excessive Authentication Attempts
Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Improper Restriction of Excessive Authentication Attempts
Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
APU0200: Improper Restriction of Excessive Authentication Attempts
Improper Restriction of Excessive Authentication Attempts in RDT400 in SICK APU allows an unprivileged remote attacker to guess the password via trial-and-error as the login attempts are not limited.
- 9.8 Critical severity
jumpserver: Improper Restriction of Excessive Authentication Attempts
JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding SSH private key. An attacker could exploit a vulnerability by utilizing a disclosed public key to at
- 9.8 Critical severity
Opencart: Improper Restriction of Excessive Authentication Attempts
OpenCart CMS v4.0.2.2 was discovered to lack a protective mechanism on its login page against excessive login attempts, allowing unauthenticated attackers to gain access to the application via a brute force attack to the password parameter.
- 7.5 High severity
Guardium Cloud Key Manager: Improper Restriction of Excessive Authentication Attempts
IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 248126.
- 7.5 High severity
Security Guardium: Improper Restriction of Excessive Authentication Attempts
IBM Security Guardium 11.3 and 11.4 could disclose sensitive information to an attacker due to improper restriction of excessive authentication attempts. IBM X-Force ID: 240895.
- 9.8 Critical severity
SNAP PAC S1: Improper Restriction of Excessive Authentication Attempts
There is no limit on the number of login attempts in the web server for the SNAP PAC S1 Firmware version R10.3b. This could allow for a brute-force attack on the built-in web server login.
- 7.5 High severity
Weincloud: Improper Restriction of Excessive Authentication Attempts
Weintek Weincloud v0.13.6 could allow an attacker to efficiently develop a brute force attack on credentials with authentication hints from error message responses.