Weaknesses of type CWE-307

545 results

Falta de Proteção contra Tentativas Excessivas de Autenticação

É a ausência de mecanismos que limitam o número de tentativas de login ou autenticação em um curto período. Um atacante pode fazer força bruta (testar muitas senhas ou códigos) sem ser bloqueado, permitindo descobrir credenciais válidas ou contornar fatores de autenticação como OTP.

Example

Um sistema de login não bloqueia a conta após 5 tentativas erradas nem implementa delay progressivo. Um atacante automático testa 10 mil combinações de senha em minutos contra um usuário-alvo e consegue acesso. Ou um atacante bruta-força códigos de 2FA sem que o sistema limite as tentativas.

How to mitigate

Implemente bloqueio ou throttling: limitar tentativas (ex: máx 5 por minuto), aumentar delay entre tentativas, bloquear conta temporariamente após falhas consecutivas, usar CAPTCHA após N tentativas, e registrar/alertar sobre picos de tentativas suspeitas.

CVE-2026-119746HIGHProSoft ICX35 Login Lockout Bypass via Client-Side CookiesEPSS 0.4%CVE-2024-45523CRITICALAn issue was discovered in Bravura Security Fabric versions 12.3.x before 12.3.5.32784, 12.4.x before 12.4.3.35110, 12.5.x before 12.5.2.359EPSS 0.4%CVE-2026-45010CRITICALphpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check EndpointEPSS 0.4%CVE-2024-51476HIGHIBM Concert Software information disclosureEPSS 0.4%CVE-2024-32676MEDIUMWordPress LoginPress Pro plugin < 3.0.0 - Captcha Bypass vulnerabilityEPSS 0.4%CVE-2020-37228CRITICALiDS6 DSSPro Digital Signage System 6.2 CAPTCHA Security BypassEPSS 0.4%CVE-2022-39314MEDIUMUser enumeration in the code-based login and password reset formsEPSS 0.4%CVE-2025-20196MEDIUMA vulnerability in the Cisco IOx application hosting environment of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticaEPSS 0.4%CVE-2026-31903HIGHIGL-Technologies eParking.fi Improper Restriction of Excessive Authentication AttemptsEPSS 0.4%CVE-2025-53968HIGHEVMAPA Improper Restriction of Excessive Authentication AttemptsEPSS 0.4%CVE-2019-5035CRITICALAn exploitable information disclosure vulnerability exists in the Weave PASE pairing functionality of the Nest Cam IQ Indoor, version 462000EPSS 0.4%CVE-2026-22629LOWAn improper restriction of excessive authentication attempts vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.EPSS 0.4%CVE-2026-30959MEDIUMOneUptime has WhatsApp Resend Verification Authorization BypassEPSS 0.4%CVE-2025-53544HIGHTrilium Notes is Vulnerable to Brute-force Protection Bypass via Initial Sync Seed RetrievalEPSS 0.4%CVE-2026-35675HIGHphpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/updateEPSS 0.4%CVE-2026-78617MEDIUMWatchGuard Dimension Web UI Authentication Brute-Force Due to Missing Rate LimitingEPSS 0.4%CVE-2026-8285MEDIUMOTP Bypass in Universal Sotware's FlexCityEPSS 0.4%CVE-2026-109949HIGHFreeRDP 3.0.0 before 3.32.0 PIN Brute-Force via Virtual SmartcardEPSS 0.4%CVE-2025-12310MEDIUMVirtFusion Email Change _settings excessive authenticationEPSS 0.4%CVE-2024-39874HIGHA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly imEPSS 0.4%