Weaknesses of type CWE-307

484 results

Falta de Proteção contra Tentativas Excessivas de Autenticação

É a ausência de mecanismos que limitam o número de tentativas de login ou autenticação em um curto período. Um atacante pode fazer força bruta (testar muitas senhas ou códigos) sem ser bloqueado, permitindo descobrir credenciais válidas ou contornar fatores de autenticação como OTP.

Example

Um sistema de login não bloqueia a conta após 5 tentativas erradas nem implementa delay progressivo. Um atacante automático testa 10 mil combinações de senha em minutos contra um usuário-alvo e consegue acesso. Ou um atacante bruta-força códigos de 2FA sem que o sistema limite as tentativas.

How to mitigate

Implemente bloqueio ou throttling: limitar tentativas (ex: máx 5 por minuto), aumentar delay entre tentativas, bloquear conta temporariamente após falhas consecutivas, usar CAPTCHA após N tentativas, e registrar/alertar sobre picos de tentativas suspeitas.

CVE-2026-33419CRITICALMinIO: LDAP login brute-force via user enumeration and missing rate limitEPSS 0.4%CVE-2026-20882HIGHMobiliti e-mobi.hu Improper Restriction of Excessive Authentication AttemptsEPSS 0.4%CVE-2024-45523CRITICALAn issue was discovered in Bravura Security Fabric versions 12.3.x before 12.3.5.32784, 12.4.x before 12.4.3.35110, 12.5.x before 12.5.2.359EPSS 0.4%CVE-2024-32676MEDIUMWordPress LoginPress Pro plugin < 3.0.0 - Captcha Bypass vulnerabilityEPSS 0.4%CVE-2020-37228CRITICALiDS6 DSSPro Digital Signage System 6.2 CAPTCHA Security BypassEPSS 0.4%CVE-2025-53968HIGHEVMAPA Improper Restriction of Excessive Authentication AttemptsEPSS 0.4%CVE-2023-44235MEDIUMWordPress WP Captcha plugin <= 2.0.0 - Captcha Bypass vulnerabilityEPSS 0.4%CVE-2026-31904HIGHCTEK Chargeportal Improper Restriction of Excessive Authentication AttemptsEPSS 0.4%CVE-2026-73046CRITICALSiYuan before v3.7.4 Authentication Bypass via HTTP Basic AuthEPSS 0.4%CVE-2019-5035CRITICALAn exploitable information disclosure vulnerability exists in the Weave PASE pairing functionality of the Nest Cam IQ Indoor, version 462000EPSS 0.4%CVE-2024-51476HIGHIBM Concert Software information disclosureEPSS 0.4%CVE-2025-12310MEDIUMVirtFusion Email Change _settings excessive authenticationEPSS 0.4%CVE-2025-48014HIGHImproper Restriction of Excessive Authentication AttemptsEPSS 0.4%CVE-2026-19297CRITICALInsufficient Authentication Brute Force Protection on Login EndpointEPSS 0.4%CVE-2026-8285MEDIUMOTP Bypass in Universal Sotware's FlexCityEPSS 0.4%CVE-2025-6004MEDIUMVault Userpass and LDAP User Lockout BypassEPSS 0.4%CVE-2025-42615HIGHImproper Restriction of Excessive Authentication Attempts vulnerability in CIRCL Vulnerability-LookupEPSS 0.4%CVE-2026-48071MEDIUMOpenReception's client PIN challenge throttle is keyed by emailHash only, allowing cross-tenant lockoutEPSS 0.4%CVE-2025-4319CRITICALImproper Access Control in Birebirsoft's SufirmamEPSS 0.4%CVE-2026-61458HIGHPasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottled EndpointEPSS 0.4%