Weaknesses of type CWE-307

545 results

Falta de Proteção contra Tentativas Excessivas de Autenticação

É a ausência de mecanismos que limitam o número de tentativas de login ou autenticação em um curto período. Um atacante pode fazer força bruta (testar muitas senhas ou códigos) sem ser bloqueado, permitindo descobrir credenciais válidas ou contornar fatores de autenticação como OTP.

Example

Um sistema de login não bloqueia a conta após 5 tentativas erradas nem implementa delay progressivo. Um atacante automático testa 10 mil combinações de senha em minutos contra um usuário-alvo e consegue acesso. Ou um atacante bruta-força códigos de 2FA sem que o sistema limite as tentativas.

How to mitigate

Implemente bloqueio ou throttling: limitar tentativas (ex: máx 5 por minuto), aumentar delay entre tentativas, bloquear conta temporariamente após falhas consecutivas, usar CAPTCHA após N tentativas, e registrar/alertar sobre picos de tentativas suspeitas.

CVE-2025-36064MEDIUMIBM Sterling Connect:Express for Microsoft Windows information disclosureEPSS 0.5%CVE-2024-47656CRITICALUser Enumeration vulnerabilityEPSS 0.5%CVE-2025-69615CRITICALIncorrect Access Control via missing 2FA rate-limiting allowing unlimited brute-force retries and full MFA bypass with no user interaction rEPSS 0.5%CVE-2026-76940HIGHEbyte NA111-M Improper Restriction of Excessive Authentication AttemptsEPSS 0.5%CVE-2025-25595CRITICALA lack of rate limiting in the login page of Safe App version a3.0.9 allows attackers to bypass authentication via a brute force attack.EPSS 0.5%CVE-2025-5864MEDIUMTenda TDSEE App Password Reset Confirmation Code ConfirmSmsCode excessive authenticationEPSS 0.5%CVE-2023-49278MEDIUMUmbraco CMS brute force exploit can be used to collect valid usernamesEPSS 0.5%CVE-2026-78490HIGHDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper RestrictEPSS 0.5%CVE-2026-46649CRITICALJoplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected EndpointEPSS 0.5%CVE-2026-56682MEDIUM9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip HeaderEPSS 0.5%CVE-2026-20882HIGHMobiliti e-mobi.hu Improper Restriction of Excessive Authentication AttemptsEPSS 0.5%CVE-2026-78655CRITICALPunk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the sessionEPSS 0.5%CVE-2026-110770CRITICALDatabasus 3.7.0 through 3.61.0 Account Takeover via Password Reset Brute-ForceEPSS 0.5%CVE-2023-32251LOWKernel: ksmbd brute force delay bypass via asynchronous requestsEPSS 0.5%CVE-2025-10761MEDIUMHarness Login Endpoint login excessive authenticationEPSS 0.5%CVE-2025-64526MEDIUMStrapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keyingEPSS 0.5%CVE-2022-26964HIGHWeak password derivation for export in Devolutions Remote Desktop Manager before 2022.1 allows information disclosure via a password brute-fEPSS 0.5%CVE-2025-58587MEDIUMImproper Restriction of Excessive Authentication AttemptsEPSS 0.5%CVE-2023-45009MEDIUMWordPress Captcha for Contact Form 7 plugin <= 1.11.3 - Capcha Bypass vulnerabilityEPSS 0.5%CVE-2025-43863LOWvantage6 lacks brute-force protection on change password functionalityEPSS 0.5%