Weaknesses of type CWE-307

484 results

Falta de Proteção contra Tentativas Excessivas de Autenticação

É a ausência de mecanismos que limitam o número de tentativas de login ou autenticação em um curto período. Um atacante pode fazer força bruta (testar muitas senhas ou códigos) sem ser bloqueado, permitindo descobrir credenciais válidas ou contornar fatores de autenticação como OTP.

Example

Um sistema de login não bloqueia a conta após 5 tentativas erradas nem implementa delay progressivo. Um atacante automático testa 10 mil combinações de senha em minutos contra um usuário-alvo e consegue acesso. Ou um atacante bruta-força códigos de 2FA sem que o sistema limite as tentativas.

How to mitigate

Implemente bloqueio ou throttling: limitar tentativas (ex: máx 5 por minuto), aumentar delay entre tentativas, bloquear conta temporariamente após falhas consecutivas, usar CAPTCHA após N tentativas, e registrar/alertar sobre picos de tentativas suspeitas.

CVE-2026-61458HIGHPasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottled EndpointEPSS 0.4%CVE-2026-31903HIGHIGL-Technologies eParking.fi Improper Restriction of Excessive Authentication AttemptsEPSS 0.4%CVE-2024-9342MEDIUMIn Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of faEPSS 0.4%CVE-2026-10216MEDIUMunitedbyai droidclaw claim Endpoint pairing.ts excessive authenticationEPSS 0.4%CVE-2026-22278HIGHDell PowerScale OneFS versions prior to 9.13.0.0 contains an improper restriction of excessive authentication attempts vulnerability. An unaEPSS 0.4%CVE-2022-43947MEDIUMAn improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiOS version 7.2.0 through 7.2.3 and befEPSS 0.4%CVE-2026-78551HIGHRansomLook Login Endpoint Allows Timing-Based Username Enumeration and Unthrottled Authentication AttemptsEPSS 0.4%CVE-2025-62399HIGHMoodle: password brute force risk when mobile/web services enabledEPSS 0.4%CVE-2023-45009MEDIUMWordPress Captcha for Contact Form 7 plugin <= 1.11.3 - Capcha Bypass vulnerabilityEPSS 0.4%CVE-2026-19895MEDIUMopensourcepos Open Source Point of Sale Login Endpoint Filters.php index excessive authenticationEPSS 0.4%CVE-2026-56234MEDIUMCapgo - Password Spraying via Public-Key Accessible Credential Validation EndpointEPSS 0.4%CVE-2024-8429MEDIUMImproper Authentication in Digital Operation Services' WiFiBuradaEPSS 0.4%CVE-2025-20196MEDIUMA vulnerability in the Cisco IOx application hosting environment of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticaEPSS 0.4%CVE-2026-65894HIGHImproper Authentication Vulnerability in CP PLUS EZ-P21 IP CameraEPSS 0.4%CVE-2024-48143CRITICALA lack of rate limiting in the OTP validation component of Digitory Multi Channel Integrated POS v1.0 allows attackers to gain access to theEPSS 0.4%CVE-2024-28833MEDIUMMissing brute-force protection for two factor authenticationEPSS 0.4%CVE-2024-9928MEDIUMA vulnerability exists in NSD570 login panel that does not restrict excessive authentication attempts. If exploited, this could cause accounEPSS 0.4%CVE-2025-36758MEDIUMBypass of bruteforce protection in SolaX CloudEPSS 0.4%CVE-2026-8793MEDIUMPaperCut NG/MF: Insufficient brute-force protectionEPSS 0.4%CVE-2025-56224HIGHA lack of rate limiting in the One-Time Password (OTP) verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification viEPSS 0.4%