Weaknesses of type CWE-307

545 results

Falta de Proteção contra Tentativas Excessivas de Autenticação

É a ausência de mecanismos que limitam o número de tentativas de login ou autenticação em um curto período. Um atacante pode fazer força bruta (testar muitas senhas ou códigos) sem ser bloqueado, permitindo descobrir credenciais válidas ou contornar fatores de autenticação como OTP.

Example

Um sistema de login não bloqueia a conta após 5 tentativas erradas nem implementa delay progressivo. Um atacante automático testa 10 mil combinações de senha em minutos contra um usuário-alvo e consegue acesso. Ou um atacante bruta-força códigos de 2FA sem que o sistema limite as tentativas.

How to mitigate

Implemente bloqueio ou throttling: limitar tentativas (ex: máx 5 por minuto), aumentar delay entre tentativas, bloquear conta temporariamente após falhas consecutivas, usar CAPTCHA após N tentativas, e registrar/alertar sobre picos de tentativas suspeitas.

CVE-2026-73529MEDIUMPlainpad Missing Rate Limiting via POST /v1/sessionsEPSS 0.4%CVE-2026-24696HIGHEveron api.everon.io Improper Restriction of Excessive Authentication AttemptsEPSS 0.4%CVE-2026-10216MEDIUMunitedbyai droidclaw claim Endpoint pairing.ts excessive authenticationEPSS 0.4%CVE-2026-105237MEDIUMlinlinjava litemall Login Endpoint AdminAuthController.java excessive authenticationEPSS 0.4%CVE-2022-43947MEDIUMAn improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiOS version 7.2.0 through 7.2.3 and befEPSS 0.4%CVE-2026-116238CRITICALpgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checksEPSS 0.4%CVE-2025-62399HIGHMoodle: password brute force risk when mobile/web services enabledEPSS 0.4%CVE-2026-122049MEDIUMCampcodes Bitcoin Wallet System ForgotPasswordController.php random_int excessive authenticationEPSS 0.4%CVE-2025-4319CRITICALImproper Access Control in Birebirsoft's SufirmamEPSS 0.4%CVE-2026-88770MEDIUMKeycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accountsEPSS 0.4%CVE-2026-66340MEDIUMMira Hormone Monitor, Mira Android App Improper restriction of excessive authentication attemptsEPSS 0.4%CVE-2026-56234MEDIUMCapgo - Password Spraying via Public-Key Accessible Credential Validation EndpointEPSS 0.4%CVE-2026-22278HIGHDell PowerScale OneFS versions prior to 9.13.0.0 contains an improper restriction of excessive authentication attempts vulnerability. An unaEPSS 0.4%CVE-2024-49342HIGHIBM Informix Dynamic Server information disclosureEPSS 0.4%CVE-2024-48143CRITICALA lack of rate limiting in the OTP validation component of Digitory Multi Channel Integrated POS v1.0 allows attackers to gain access to theEPSS 0.4%CVE-2024-8429MEDIUMImproper Authentication in Digital Operation Services' WiFiBuradaEPSS 0.4%CVE-2026-75575MEDIUMRocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor MethodEPSS 0.4%CVE-2025-69246MEDIUMLack of bruteforce protection in Raytha CMSEPSS 0.4%CVE-2026-53997CRITICALNetherman Portal del Hermano Account Takeover via Password Reset OracleEPSS 0.4%CVE-2026-48071MEDIUMOpenReception's client PIN challenge throttle is keyed by emailHash only, allowing cross-tenant lockoutEPSS 0.4%