cve.bz

CWE-307: Improper Restriction of Excessive Authentication Attempts, page 4

Filter

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

What the weakness is: CWE-307 at MITRE. OWASP Top 10: A07:2025 Authentication Failures

Related attack patterns (CAPEC): 7
  • CAPEC-16 Dictionary-based Password Attack Likelihood: Medium · Severity: High
  • CAPEC-49 Password Brute Forcing Likelihood: Medium · Severity: High
  • CAPEC-560 Use of Known Domain Credentials Likelihood: High · Severity: High
  • CAPEC-565 Password Spraying Likelihood: High · Severity: High
  • CAPEC-600 Credential Stuffing Likelihood: High · Severity: High
  • CAPEC-652 Use of Known Kerberos Credentials Likelihood: Medium · Severity: High
  • CAPEC-653 Use of Known Operating System Credentials Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-307, as MITRE names them. Credits.

Ask an AI about CWE-307

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-307: Improper Restriction of Excessive Authentication Attempts and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/307.html and https://cve.bz/cve/cwe/307?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 2.9CVE-2026-7671EPSS 0.6%

    A vulnerability has been found in CodeWise Tornet Scooter Mobile App 4.75 on iOS/Android. The impacted element is an unknown function of the file /TwoFactor. Such manipulation leads to improper restriction of excessive authentication attem…

  2. 7.5CVE-2026-36959EPSS 0.3%

    U-SPEED N300 router V1.0.0 does not implement rate limiting or account lockout protections on the /api/login endpoint. This allows an attacker on the local network to perform unlimited authentication attempts, enabling brute-force attacks …

  3. 6.5CVE-2026-26206EPSS 0.2%

    Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, Wazuh's server API brute-force protection for POST /security/user/authenticate can be bypassed by se…

  4. 6.2CVE-2026-35902EPSS 0.2%

    The RTSP service of MERCURY IP camera MIPC252W 1.0.5 Build 230306 has an issue handling failed Digest authentication attempts. By repeatedly sending RTSP requests with invalid authentication parameters, an unauthenticated attacker can caus…

  5. 8.7CVE-2026-6947EPSS 0.6%

    DWM-222W USB Wi-Fi Adapter developed by D-Link has a Brute-Force Protection Bypass vulnerability, allowing unauthenticated adjacent network attackers to bypass login attempt limits to perform brute-force attacks to gain control over the de…

  6. 5.9CVE-2026-41213EPSS 0.3%

    @node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid code_verifier values (including one-character strings) for S256 PKCE flows. Because short/weak verifiers ar…

  7. 7.5CVE-2026-40586EPSS 0.4%

    blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the login form handler performs no throttling of any kind. Failed authentication attempts are processed at full network speed with no IP-based rate limiting, no per-ac…

  8. 7.3CVE-2025-14362EPSS 0.2%

    The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute …

  9. 8.7CVE-2026-41037EPSS 0.2%

    This vulnerability exists in Quantum Networks router due to missing rate limiting and CAPTCHA protection for failed login attempts in the web-based management interface. An attacker on the same network could exploit this vulnerability by p…

  10. 5.3CVE-2026-40485EPSS 0.3%

    ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the public API login endpoint (/api/public/user/login) returns distinguishable HTTP response codes based on whether a username exists: 404 for non-existent u…

  11. 7.2CVE-2025-46606EPSS 0.4%

    Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain an improper restriction of excessive authentication attempts vulnerability. A high privileged attacker with remote …

  12. 7.5CVE-2026-22616EPSS 0.3%

    Eaton Intelligent Power Protector (IPP) software allows repeated authentication attempts against the web interface login page due to insufficient rate‑limiting controls. This security issue has been fixed in the latest version of Eaton IPP…

  13. 7.4CVE-2026-33667EPSS 0.3%

    OpenProject is an open-source project management application. In versions prior to 17.3.0, 2FA OTP verification in the confirm_otp action of the two_factor_authentication module has no rate limiting, lockout mechanism, or failed-attempt tr…

  14. 6.9CVE-2026-2402EPSS 0.3%

    CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to gain access to the user account by performing an arbitrary number of authentication attempts with different credentials …

  15. 9.8CVE-2025-31991EPSS 0.2%

    Rate Limiting for attempting a user login is not being properly enforced, making HCL DevOps Velocity susceptible to brute-force attacks past the unsuccessful login attempt limit.  This vulnerability is fixed in 5.1.7.

  16. 7.5CVE-2026-35597EPSS 0.3%

    Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the TOTP failed-attempt lockout mechanism is non-functional due to a database transaction handling bug. When a TOTP validation fails, the login handler in pkg/…

  17. 6.3CVE-2026-35646EPSS 0.2%

    OpenClaw before 2026.3.25 contains a pre-authentication rate-limit bypass vulnerability in webhook token validation that allows attackers to brute-force weak webhook secrets. The vulnerability exists because invalid webhook tokens are reje…

  18. 6.3CVE-2026-35628EPSS 0.3%

    OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in Telegram webhook authentication that allows attackers to brute-force weak webhook secrets. The vulnerability enables repeated authentication guesses without thrott…

  19. 6.3CVE-2026-35623EPSS 0.4%

    OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in webhook authentication that allows attackers to brute-force weak webhook passwords without throttling. Remote attackers can repeatedly submit incorrect password gu…

  20. 6.3CVE-2026-33580EPSS 0.4%

    OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak shared secrets. Attackers who can reach the webhook endpoint can exploit this t…

  21. 6.9CVE-2026-34505EPSS 0.3%

    OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook secrets. Attackers can submit repeated authentication requests with invalid secr…

  22. 2.7CVE-2026-33879EPSS 0.3%

    Federated Learning and Interoperability Platform (FLIP) is an open-source platform for federated training and evaluation of medical imaging AI models across healthcare institutions. The FLIP login page in versions 0.1.1 and prior has no ra…

  23. 5.3CVE-2026-33763EPSS 0.3%

    WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `get_api_video_password_is_correct` API endpoint allows any unauthenticated user to verify whether a given password is correct for any password-protect…

  24. 7.7CVE-2026-33935EPSS 0.6%

    MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.72, an unauthenticated attacker can lock out administrator and visitor accounts from password-based authentication by triggering failed login att…

  25. 9.1CVE-2026-33640EPSS 0.5%

    Outline is a service that allows for collaborative documentation. Outline implements an Email OTP login flow for users not associated with an Identity Provider. Starting in version 0.86.0 and prior to version 1.6.0, Outline does not invali…

  26. 7.5CVE-2026-33152EPSS 0.5%

    Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, Tandoor Recipes configures Django REST Framework with BasicAuthentication as one of the default authentication…

  27. 9.1CVE-2026-33419EPSS 0.5%

    MinIO is a high-performance object storage system. Prior to RELEASE.2026-03-17T21-25-16Z, MinIO AIStor's STS (Security Token Service) AssumeRoleWithLDAPIdentity endpoint is vulnerable to LDAP credential brute-forcing due to two combined we…

  28. 7.7CVE-2026-31851EPSS 0.3%

    Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement rate limiting or account lockout mechanisms on authentication interfaces. An attacker can perform unlimited authentication attempts against endpoints that …

  29. 8.7CVE-2026-31904EPSS 0.4%

    The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate …

  30. 8.7CVE-2026-31903EPSS 0.4%

    The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate …

  31. 7.5CVE-2026-32025EPSS 0.3%

    OpenClaw versions prior to 2026.2.25 contain an authentication hardening gap in browser-origin WebSocket clients that allows attackers to bypass origin checks and auth throttling on loopback deployments. An attacker can trick a user into o…

  32. 9.3CVE-2026-32295EPSS 0.5%

    JetKVM before 0.5.4 does not rate limit login requests, enabling brute-force attempts to guess credentials.

  33. 9.3CVE-2026-32292EPSS 0.6%

    The GL-iNet Comet (GL-RM1) KVM web interface does not limit login requests, enabling brute-force attempts to guess credentials.

  34. 8.8CVE-2026-32729EPSS 0.4%

    Runtipi is a personal homeserver orchestrator. Prior to 4.8.1, The Runtipi /api/auth/verify-totp endpoint does not enforce any rate limiting, attempt counting, or account lockout mechanism. An attacker who has obtained a user's valid crede…

  35. 6.9CVE-2025-69246EPSS 0.4%

    Raytha CMS does not have any brute force protection mechanism implemented. It allows an attacker to send multiple automated logon requests without triggering lockout, throttling, or step-up challenges. This issue was fixed in version 1.4.…

  36. 4.4CVE-2026-31863EPSS 0.1%

    Anytype Heart is the middleware library for Anytype. The challenge-based authentication for the local gRPC client API can be bypassed, allowing an attacker to gain access without the 4-digit code. This vulnerability is fixed in anytype-hea…

  37. 6.5CVE-2025-66413EPSS 0.3%

    Git for Windows is the Windows port of Git. Prior to 2.53.0(2), it is possible to obtain a user's NTLM hash by tricking them into cloning from a malicious server. Since NTLM hashing is weak, it is possible for the attacker to brute-force t…

  38. 5.3CVE-2026-30959EPSS 0.4%

    OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated (u…

  39. 3.7CVE-2026-22629EPSS 0.4%

    An improper restriction of excessive authentication attempts vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4 all versions, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all…

  40. 9.1CVE-2025-69615EPSS 0.5%

    Incorrect Access Control via missing 2FA rate-limiting allowing unlimited brute-force retries and full MFA bypass with no user interaction required. Affected Product: Deutsche Telekom AG Telekom Account Management Portal, versions before 2…

  41. 8.7CVE-2026-24696EPSS 0.4%

    The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate …

  42. 8.7CVE-2026-20882EPSS 0.5%

    The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate …

  43. 8.7CVE-2026-27778EPSS 0.7%

    The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate …

  44. 6.0CVE-2026-27801EPSS 0.3%

    Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Vaultwarden versions 1.34.3 and prior are susceptible to a 2FA bypass when performing protected actions. An attacker who gains authen…

  45. 7.4CVE-2026-27981EPSS 0.3%

    HomeBox is a home inventory and organization system. Prior to 0.24.0, the authentication rate limiter (authRateLimiter) tracks failed attempts per client IP. It determines the client IP by reading, 1. X-Real-IP header, 2. First entry of X-…

  46. 7.5CVE-2025-36363EPSS 0.3%

    IBM DevOps Plan 3.0.0 through 3.0.5 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.

  47. 5.3CVE-2026-27824EPSS 0.2%

    calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Server's brute-force protection mechanism uses a ban key derived from both `remote_addr` and t…

  48. 6.9CVE-2026-27753EPSS 0.4%

    SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain an authentication bypass vulnerability that allows remote attackers to perform unlimited login attempts against the management interface. Attackers can conduct online passw…

  49. 8.7CVE-2026-26305EPSS 0.5%

    The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitima…

  50. 8.7CVE-2026-24445EPSS 0.6%

    The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitima…