Weaknesses of type CWE-307

545 results

Falta de Proteção contra Tentativas Excessivas de Autenticação

É a ausência de mecanismos que limitam o número de tentativas de login ou autenticação em um curto período. Um atacante pode fazer força bruta (testar muitas senhas ou códigos) sem ser bloqueado, permitindo descobrir credenciais válidas ou contornar fatores de autenticação como OTP.

Example

Um sistema de login não bloqueia a conta após 5 tentativas erradas nem implementa delay progressivo. Um atacante automático testa 10 mil combinações de senha em minutos contra um usuário-alvo e consegue acesso. Ou um atacante bruta-força códigos de 2FA sem que o sistema limite as tentativas.

How to mitigate

Implemente bloqueio ou throttling: limitar tentativas (ex: máx 5 por minuto), aumentar delay entre tentativas, bloquear conta temporariamente após falhas consecutivas, usar CAPTCHA após N tentativas, e registrar/alertar sobre picos de tentativas suspeitas.

CVE-2024-5862HIGHUser Enumeration in Mia Technology's Mia-Med Health AplicationEPSS 0.5%CVE-2026-61611HIGHLychee: Missing rate limiting on album password unlock endpoint allows brute-force attacksEPSS 0.5%CVE-2026-71213CRITICALtypemill - No Rate Limiting on Login Endpoint Enables Unlimited Password Brute-ForceEPSS 0.5%CVE-2026-102334CRITICALNginx Proxy Manager through 2.16.0 Missing Brute-Force ProtectionEPSS 0.5%CVE-2024-3102MEDIUMJSON Injection in mintplex-labs/anything-llmEPSS 0.5%CVE-2026-47203LOWAuthelia Missing Username Canonicalization in Basic Auth (LDAP)EPSS 0.5%CVE-2026-3329HIGHNexus Repository Manager - Improper Restriction of Excessive Authentication AttemptsEPSS 0.4%CVE-2026-76213CRITICALphpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped ThrottleEPSS 0.4%CVE-2026-82644HIGHWWBN AVideo Brute-force Rate Limiting Bypass via Missing User-AgentEPSS 0.4%CVE-2025-11566MEDIUMCWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network toEPSS 0.4%CVE-2026-111356CRITICALMacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-ForceEPSS 0.4%CVE-2023-41270LOWSamsung Smart TV UE40D7000 WPS DoS attackEPSS 0.4%CVE-2025-1740CRITICALAuthentication Bypass in Akinsoft's MyRezztaEPSS 0.4%CVE-2024-39873HIGHA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly imEPSS 0.4%CVE-2026-31904HIGHCTEK Chargeportal Improper Restriction of Excessive Authentication AttemptsEPSS 0.4%CVE-2024-41682MEDIUMA vulnerability has been identified in Location Intelligence family (All versions < V4.4). Affected products do not properly enforce restricEPSS 0.4%CVE-2022-34389LOW Dell SupportAssist contains a rate limit bypass issues in screenmeet API third party component. An unauthenticated attacker could potentialEPSS 0.4%CVE-2025-48014HIGHImproper Restriction of Excessive Authentication AttemptsEPSS 0.4%CVE-2025-2411HIGHOTP Bypass in Akinsoft's TaskPanoEPSS 0.4%CVE-2025-2417HIGHOTP Bypass in Akinsoft's e-MutabakatEPSS 0.4%