Weaknesses of type CWE-307

545 results

Falta de Proteção contra Tentativas Excessivas de Autenticação

É a ausência de mecanismos que limitam o número de tentativas de login ou autenticação em um curto período. Um atacante pode fazer força bruta (testar muitas senhas ou códigos) sem ser bloqueado, permitindo descobrir credenciais válidas ou contornar fatores de autenticação como OTP.

Example

Um sistema de login não bloqueia a conta após 5 tentativas erradas nem implementa delay progressivo. Um atacante automático testa 10 mil combinações de senha em minutos contra um usuário-alvo e consegue acesso. Ou um atacante bruta-força códigos de 2FA sem que o sistema limite as tentativas.

How to mitigate

Implemente bloqueio ou throttling: limitar tentativas (ex: máx 5 por minuto), aumentar delay entre tentativas, bloquear conta temporariamente após falhas consecutivas, usar CAPTCHA após N tentativas, e registrar/alertar sobre picos de tentativas suspeitas.

CVE-2023-2675MEDIUMImproper Restriction of Excessive Authentication Attempts in linagora/twakeEPSS 0.6%CVE-2023-45149MEDIUMPassword of talk conversations can be bruteforced in NextcloudEPSS 0.6%CVE-2025-56221CRITICALA lack of rate limiting in the login mechanism of SigningHub v8.6.8 allows attackers to bypass authentication via a brute force attack.EPSS 0.6%CVE-2026-25945HIGHEV2GO ev2go.io Improper Restriction of Excessive Authentication AttemptsEPSS 0.6%CVE-2023-36917MEDIUMPassword Change rate limit bypass in SAP BusinessObjects Business Intelligence PlatformEPSS 0.6%CVE-2026-14254HIGHImproper Restriction of Excessive Authentication Attempts in Delphix Continuous DataEPSS 0.6%CVE-2026-56450MEDIUMAIL Framework - Missing Rate Limiting Enables Brute-Force Attacks Against Two-Factor Authentication CodesEPSS 0.6%CVE-2026-118505MEDIUMAshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resourceEPSS 0.6%CVE-2026-6223CRITICALOTP Bypass in Bahçelievler Muncipality's BiHayat AppEPSS 0.6%CVE-2024-49597HIGHDell Wyse Management Suite, versions WMS 4.4 and prior, contain an Improper Restriction of Excessive Authentication Attempts vulnerability. EPSS 0.6%CVE-2025-3709CRITICALFlowring Technology Agentflow - Account Lockout BypassEPSS 0.6%CVE-2026-19897MEDIUMmangroup dtale Login Endpoint auth.py login excessive authenticationEPSS 0.6%CVE-2026-6947HIGHD-Link｜DWM-222W USB Wi-Fi Adapter - Brute-Force Protection BypassEPSS 0.6%CVE-2024-51558CRITICALBrute Force Attack Vulnerability in Wave 2.0EPSS 0.6%CVE-2026-7671MEDIUMCodeWise Tornet Scooter Mobile App TwoFactor excessive authenticationEPSS 0.6%CVE-2026-33935HIGHMyTube has Unauthenticated Account Lockout via Shared Login Attempt StateEPSS 0.6%CVE-2026-35098MEDIUMImproper Restriction of Excessive Authentication Attempts in KTM System e-BOKEPSS 0.6%CVE-2024-45790CRITICALUser Enumeration vulnerabilityEPSS 0.6%CVE-2024-47088CRITICALUser Enumeration vulnerabilityEPSS 0.6%CVE-2026-32292CRITICALGL-iNet Comet (GL-RM1) KVM insufficient login rate-limitingEPSS 0.6%