Weaknesses of type CWE-307

545 results

Falta de Proteção contra Tentativas Excessivas de Autenticação

É a ausência de mecanismos que limitam o número de tentativas de login ou autenticação em um curto período. Um atacante pode fazer força bruta (testar muitas senhas ou códigos) sem ser bloqueado, permitindo descobrir credenciais válidas ou contornar fatores de autenticação como OTP.

Example

Um sistema de login não bloqueia a conta após 5 tentativas erradas nem implementa delay progressivo. Um atacante automático testa 10 mil combinações de senha em minutos contra um usuário-alvo e consegue acesso. Ou um atacante bruta-força códigos de 2FA sem que o sistema limite as tentativas.

How to mitigate

Implemente bloqueio ou throttling: limitar tentativas (ex: máx 5 por minuto), aumentar delay entre tentativas, bloquear conta temporariamente após falhas consecutivas, usar CAPTCHA após N tentativas, e registrar/alertar sobre picos de tentativas suspeitas.

CVE-2026-20792HIGHChargemap chargemap.com Improper Restriction of Excessive Authentication AttemptsEPSS 0.6%CVE-2026-24445HIGHEV Energy ev.energy Improper Restriction of Excessive Authentication AttemptsEPSS 0.6%CVE-2023-3548HIGHIQ Wifi 6EPSS 0.5%CVE-2023-42480MEDIUMInformation Disclosure in NetWeaver AS Java LogonEPSS 0.5%CVE-2026-17280HIGHMultiple Vulnerabilities in IBM API ConnectEPSS 0.5%CVE-2024-46442CRITICALAn issue in the BYD Dilink Headunit System v3.0 to v4.0 allows attackers to bypass authentication via a bruteforce attack.EPSS 0.5%CVE-2022-38491HIGHAn issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. Part of the application does not implement protection against brute-fEPSS 0.5%CVE-2025-48187CRITICALRAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification cEPSS 0.5%CVE-2026-37603MEDIUMImproper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder (pH7 Social Dating CMS) throEPSS 0.5%CVE-2026-13348MEDIUMCWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized acEPSS 0.5%CVE-2023-32657MEDIUMWeintek Weincloud Improper Restriction of Excessive Authentication AttemptsEPSS 0.5%CVE-2024-8462MEDIUMWindmill HTTP Request users.rs excessive authenticationEPSS 0.5%CVE-2025-49195MEDIUMNo protection against brute-force attacksEPSS 0.5%CVE-2026-25114HIGHCloudCharge cloudcharge.se Improper Restriction of Excessive Authentication AttemptsEPSS 0.5%CVE-2025-52997MEDIUMFile Browser Insecurely Handles PasswordsEPSS 0.5%CVE-2026-26305HIGHMobility46 mobility46.se Improper Restriction of Excessive Authentication AttemptsEPSS 0.5%CVE-2026-25113HIGHSWITCH EV swtchenergy.com Improper Restriction of Excessive Authentication AttemptsEPSS 0.5%CVE-2024-41904HIGHA vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application do not prEPSS 0.5%CVE-2023-54347HIGHOpenEMR 7.0.1 Authentication Brute Force Mitigation BypassEPSS 0.5%CVE-2026-42952HIGHHydro-Québec Le Circuit Electrique charging station backend Improper Restriction of Excessive Authentication AttemptsEPSS 0.5%