Weaknesses of type CWE-307

545 results

Falta de Proteção contra Tentativas Excessivas de Autenticação

É a ausência de mecanismos que limitam o número de tentativas de login ou autenticação em um curto período. Um atacante pode fazer força bruta (testar muitas senhas ou códigos) sem ser bloqueado, permitindo descobrir credenciais válidas ou contornar fatores de autenticação como OTP.

Example

Um sistema de login não bloqueia a conta após 5 tentativas erradas nem implementa delay progressivo. Um atacante automático testa 10 mil combinações de senha em minutos contra um usuário-alvo e consegue acesso. Ou um atacante bruta-força códigos de 2FA sem que o sistema limite as tentativas.

How to mitigate

Implemente bloqueio ou throttling: limitar tentativas (ex: máx 5 por minuto), aumentar delay entre tentativas, bloquear conta temporariamente após falhas consecutivas, usar CAPTCHA após N tentativas, e registrar/alertar sobre picos de tentativas suspeitas.

CVE-2025-64310CRITICALEPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products do not restrict excessive authentication attempts. An administrativEPSS 0.5%CVE-2026-111874MEDIUMOpenCATS Career Portal CareersUI.php processLogin excessive authenticationEPSS 0.5%CVE-2026-69183HIGHMonkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)EPSS 0.5%CVE-2023-34001MEDIUMWordPress Hide My WP Ghost – Security Plugin plugin <= 5.0.25 - Captcha Bypass vulnerabilityEPSS 0.5%CVE-2025-2171HIGHAviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversEPSS 0.5%CVE-2024-9342MEDIUMIn Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of faEPSS 0.5%CVE-2026-33640CRITICALOutline has a rate limit bypass that allows brute force of email login OTPEPSS 0.5%CVE-2023-26271MEDIUMIBM Security Guardium Data Encryption information disclosureEPSS 0.5%CVE-2024-42465CRITICALLack of resources and rate limiting - two factor authenticationEPSS 0.5%CVE-2024-32774MEDIUMWordPress ProfileGrid plugin <= 5.8.2 - Group Members Limit Bypass vulnerabilityEPSS 0.5%CVE-2025-6004MEDIUMVault Userpass and LDAP User Lockout BypassEPSS 0.5%CVE-2026-24436CRITICALTenda W30E V2 Lacks Rate Limiting on AuthenticationEPSS 0.5%CVE-2025-67853HIGHMoodle: moodle: brute-force facilitation due to missing rate limiting in confirmation email serviceEPSS 0.5%CVE-2025-42600HIGHBrute Force Attack Vulnerability in Meon KYC solutionsEPSS 0.5%CVE-2024-0787MEDIUMImproper Restriction of Excessive Authentication Attempts in phpipam/phpipamEPSS 0.5%CVE-2024-22425MEDIUMDell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains a brute force/dictionary attack vulnerability. An unauthenticated remote attaEPSS 0.5%CVE-2026-95739HIGHUnauthenticated Improper Restriction of Excessive Authentication Attempts in the API of HPE Networking Fabric ComposerEPSS 0.5%CVE-2026-85237HIGHMissing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication BypassEPSS 0.5%CVE-2024-32868MEDIUMZITADEL's Improper Lockout Mechanism Leads to MFA BypassEPSS 0.5%CVE-2026-33419CRITICALMinIO: LDAP login brute-force via user enumeration and missing rate limitEPSS 0.5%