CWE-645: Overly Restrictive Account Lockout Mechanism
Filter
The product contains an account lockout protection mechanism, but the mechanism is too restrictive and can be triggered too easily, which allows attackers to deny service to legitimate users by causing their accounts to be locked out.
What the weakness is: CWE-645 at MITRE. All weaknesses
Related attack patterns (CAPEC): 1
- CAPEC-2 Inducing Account Lockout Likelihood: High · Severity: Medium
The attack patterns MITRE's CAPEC relates to CWE-645, as MITRE names them. Credits.
Ask an AI about CWE-645
Show the prompt
Explain CWE-645: Overly Restrictive Account Lockout Mechanism and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/645.html and https://cve.bz/cve/cwe/645?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 5.3CVE-2026-35161EPSS 0.4%
Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Overly Restrictive Account Lockout Mechanism vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial…
- 6.9CVE-2026-105866EPSS 0.4%
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account lo…
- 7.1CVE-2026-53982EPSS 0.3%
Cap-go Console < 12.28.2 contains a denial-of-service vulnerability in its account deletion flow that allows an attacker to block authentication and onboarding functions by triggering account deletion while a device identifier is linked to…
- 7.5CVE-2026-25907EPSS 0.3%
Dell PowerScale OneFS, version 9.13.0.0, contains an overly restrictive account lockout mechanism vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.
- 5.3CVE-2025-5241EPSS 0.4%
Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series allows a remote unauthenticated attacker to lockout legitimate users for a certain period by repeatedly attempting to login wi…
- 5.3CVE-2025-31947EPSS 0.4%
Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures…
- 6.3CVE-2024-37028EPSS 0.4%
BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- 5.3CVE-2024-1722EPSS 0.8%
A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in.
- 7.5CVE-2023-4346KEVEPSS 1.4%
KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices c…