cve.bz

CWE-307: Improper Restriction of Excessive Authentication Attempts, page 3

Filter

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

What the weakness is: CWE-307 at MITRE. OWASP Top 10: A07:2025 Authentication Failures

Related attack patterns (CAPEC): 7
  • CAPEC-16 Dictionary-based Password Attack Likelihood: Medium · Severity: High
  • CAPEC-49 Password Brute Forcing Likelihood: Medium · Severity: High
  • CAPEC-560 Use of Known Domain Credentials Likelihood: High · Severity: High
  • CAPEC-565 Password Spraying Likelihood: High · Severity: High
  • CAPEC-600 Credential Stuffing Likelihood: High · Severity: High
  • CAPEC-652 Use of Known Kerberos Credentials Likelihood: Medium · Severity: High
  • CAPEC-653 Use of Known Operating System Credentials Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-307, as MITRE names them. Credits.

Ask an AI about CWE-307

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-307: Improper Restriction of Excessive Authentication Attempts and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/307.html and https://cve.bz/cve/cwe/307?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.4CVE-2026-48084EPSS 0.4%

    OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passphrase login attempts. An attacker can submit unlimited wrong passphrase guesses …

  2. 5.8CVE-2026-48071EPSS 0.4%

    OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the PIN-type challenge throttle uses `emailHash` as the only key. The throttle rows live in the central `ch…

  3. 7.5CVE-2026-16619EPSS 0.3%

    The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who alrea…

  4. 9.1CVE-2026-71213EPSS 0.5%

    Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send …

  5. 6.5CVE-2026-71205EPSS 0.3%

    changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.t…

  6. 6.9CVE-2026-8793EPSS 0.7%

    PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vulnerability to perform unrestricted brute-force or credential-stuffing attacks wi…

  7. 5.3CVE-2026-15144EPSS 0.4%

    @fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range (a /64 holds 2^64 distinct addresses) and the same address …

  8. 8.7CVE-2026-16347EPSS 0.4%

    MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions,…

  9. 3.3CVE-2026-55977EPSS 0.1%

    Successful exploitation of this vulnerability could allow an attacker with local network access to bypass the application's rate-limiting mechanism, enabling brute-forcing of the screen-sharing code and potentially displaying harmful conte…

  10. 8.7CVE-2026-65894EPSS 0.7%

    This vulnerability exists in CP PLUS EZ-P21 IP Camera due to improper authentication of HTTP endpoints. A remote attacker could exploit this vulnerability by conducting brute-force attacks against HTTP endpoint on the targeted device. S…

  11. 4.3CVE-2026-8285EPSS 0.4%

    Improper restriction of excessive authentication attempts vulnerability in Universal Software Inc. FlexCity allows Excessive Allocation. This issue affects FlexCity: from 5.536.0 before 5.542.0.

  12. 7.3CVE-2026-32825EPSS 0.3%

    dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the applica…

  13. 6.3CVE-2026-62220EPSS 0.5%

    OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts. When the affected feature is enabled and reachable by lower-trust input, this c…

  14. 9.8CVE-2026-44596ExploitEPSS 2.1%

    Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, account lockout, or fail…

  15. 8.3CVE-2026-14254EPSS 0.6%

    A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout threshold to be bypassed through concurrent authentication requests. Parallel login attempts were processed before the failed-login counter and…

  16. 8.7CVE-2026-61458EPSS 0.4%

    PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a push token can systematically guess passph…

  17. 8.7CVE-2026-42952EPSS 0.5%

    Previously, there was no throttling on repeated authentication attempts to the charging station backend, which could allow an attacker to execute a denial-of-service attack.

  18. 5.9CVE-2026-11915EPSS 0.3%

    vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.

  19. 5.4CVE-2026-15079EPSS 0.3%

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions: from 0.0.0 to 2.1.4.

  20. 7.3CVE-2026-55501EPSS 0.4%

    9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/auth/loginLimiter.js derives the client identity from the attacker-controlled X-Forwarded-For HTTP header, and src/app/api/auth/login/route…

  21. 6.3CVE-2026-53904EPSS 0.3%

    MCO is vulnerable to Account Denial of Service due to improper implementation of password reset functionality. Each password reset request invalidates previously set password as well as previously issued temporary passwords, furthermore, p…

  22. 6.9CVE-2026-35098EPSS 0.6%

    KTM System e-BOK does not implement any limit or timeout on consecutive login attempts, allowing an attacker to perform unlimited authentication requests. This lack of rate‑limiting enables efficient brute‑force attacks against user accoun…

  23. 5.3CVE-2026-11779EPSS 0.4%

    An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation.

  24. 8.7CVE-2026-50176EPSS 0.7%

    The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthoriz…

  25. 6.3CVE-2026-47380EPSS 0.3%

    NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, sign-in response timing differed between known and unknown email addresses because the unknown-user branch returned without performing a password hash compariso…

  26. 6.9CVE-2026-56234EPSS 0.4%

    Capgo before 12.128.2 contains a credential validation vulnerability in the POST /functions/v1/private/validate_password_compliance endpoint that is callable using only the public Supabase key without authentication. The endpoint is CORS-p…

  27. 5.1CVE-2026-56450EPSS 0.6%

    AIL did not restrict repeated failed attempts to verify a two-factor authentication (OTP) code. An attacker who had reached the 2FA verification step, such as after successfully completing the password-authentication stage, could submit an…

  28. 2.9CVE-2026-47203EPSS 0.5%

    Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In versions 4.38.0 through 4.39.19, when a user authenticates via Basic Auth…

  29. 9.8CVE-2026-6853EPSS 0.3%

    Improper restriction of excessive authentication attempts vulnerability in Başbelen Group Food Cafe Businesses Industry and Trade Ltd. Co. Pause+ Mobile App allows Authentication Bypass. This issue affects Pause+ Mobile App: from v1.0.6 b…

  30. 8.7CVE-2026-3329EPSS 0.4%

    A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints.

  31. 6.3CVE-2026-43926EPSS 0.2%

    FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the password reset confirmation endpoint `/client/reset-password-confirm/:hash` is handled by a non-API controller and is not covered by FOSSB…

  32. 6.4CVE-2026-36612EPSS 0.1%

    Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 enables WPS 2.0 by default with a weak lockout policy (60-second lockout after 10 attempts).

  33. 8.8CVE-2026-36607EPSS 0.2%

    Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP password change endpoint (code=10), which lacks the rate limiting applied to the login endpoint (code=7). An attacker o…

  34. 2.9CVE-2026-10216EPSS 0.4%

    A vulnerability was detected in unitedbyai droidclaw up to 0.5.3. The affected element is an unknown function of the file server/src/routes/pairing.ts of the component claim Endpoint. The manipulation results in improper restriction of exc…

  35. 4.1CVE-2026-49324EPSS 0.2%

    Uncontrolled resource consumption in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with write access to the in-vehicle network to permanently immobilize t…

  36. 7.3CVE-2026-45364EPSS 0.3%

    Better Auth is an authentication and authorization library for TypeScript. Prior to 1.4.17 and 1.5.0-beta.9, Better Auth's HTTP rate limiter keyed each request by the exact textual IP address it received in x-forwarded-for (or the configur…

  37. 8.8CVE-2026-35675EPSS 0.4%

    phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user account password without token verification or email confirmation. Attackers can e…

  38. 9.8CVE-2026-8760EPSS 1.0%

    The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.6. This is due to an incomplete fix for CVE-2024-11178: the rate-limit/lockout check added to `otpl_login_action()` was …

  39. 6.3CVE-2026-1816EPSS 0.2%

    Improper restriction of excessive authentication attempts vulnerability in Turkiye Electricity Transmission Corporation (TEİAŞ) Mobile Application allows Brute Force. This issue affects Mobile Application: from 1.6.2 before 1.13.

  40. 9.3CVE-2020-37228EPSS 0.4%

    iDS6 DSSPro Digital Signage System 6.2 contains a CAPTCHA security bypass vulnerability that allows attackers to bypass authentication by requesting the autoLoginVerifyCode object. Attackers can retrieve valid CAPTCHA codes via the login e…

  41. 9.3CVE-2026-45010EPSS 0.4%

    phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary user-id parameters without session binding or rate limiting. Unauthenticated at…

  42. 6.9CVE-2025-64526EPSS 0.5%

    Strapi is an open source headless content management system. In Strapi versions prior to 5.45.0, the rate-limit middleware in the users-permissions plugin derived its rate-limit key in part from `ctx.request.body.email`, including on route…

  43. 5.4CVE-2025-62313EPSS 0.2%

    HCL AION is affected by a vulnerability where adequate protections against brute-force attempts are not enforced. This may allow repeated authentication attempts, potentially leading to unauthorized access or account compromise under certa…

  44. 6.5CVE-2026-44195EPSS 0.3%

    OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, a logic flaw in the OPNsense lockout_handler allows an unauthenticated attacker to continuously reset the authentication failure counter for their IP address. By i…

  45. 6.5CVE-2026-7255EPSS 0.2%Unsupported when assigned

    An improper restriction of excessive authentication attempts vulnerability in the web management interface of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the LAN to brute-force the password and byp…

  46. 9.8CVE-2026-43914EPSS 0.3%

    Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows bypassing the login brute-force protection if email 2fa is enabled. If email 2fa is enabled, the un…

  47. 6.9CVE-2026-7820EPSS 0.2%

    Improper restriction of excessive authentication attempts (CWE-307) in pgAdmin 4. pgAdmin enforces MAX_LOGIN_ATTEMPTS only inside its custom /authenticate/login view. Flask-Security's default /login view, which is registered automatically…

  48. 8.7CVE-2026-41893EPSS 0.3%

    Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints (POST /login and POST /signalk/v1/auth/login) are protected by express-rate-limit (default: 100 attempts per 10…

  49. 5.3CVE-2025-2514EPSS 0.3%

    Improper restriction of excessive authentication attempts vulnerability in Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900, Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, …

  50. 8.7CVE-2023-54347EPSS 0.5%

    OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protections by sending repeated login attempts to the main login endpoint. Attackers can submit POST requests with authUser an…