Weaknesses of type CWE-307

545 results

Falta de Proteção contra Tentativas Excessivas de Autenticação

É a ausência de mecanismos que limitam o número de tentativas de login ou autenticação em um curto período. Um atacante pode fazer força bruta (testar muitas senhas ou códigos) sem ser bloqueado, permitindo descobrir credenciais válidas ou contornar fatores de autenticação como OTP.

Example

Um sistema de login não bloqueia a conta após 5 tentativas erradas nem implementa delay progressivo. Um atacante automático testa 10 mil combinações de senha em minutos contra um usuário-alvo e consegue acesso. Ou um atacante bruta-força códigos de 2FA sem que o sistema limite as tentativas.

How to mitigate

Implemente bloqueio ou throttling: limitar tentativas (ex: máx 5 por minuto), aumentar delay entre tentativas, bloquear conta temporariamente após falhas consecutivas, usar CAPTCHA após N tentativas, e registrar/alertar sobre picos de tentativas suspeitas.

CVE-2026-15144HIGH@fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotationEPSS 0.4%CVE-2024-28833MEDIUMMissing brute-force protection for two factor authenticationEPSS 0.4%CVE-2024-9928MEDIUMA vulnerability exists in NSD570 login panel that does not restrict excessive authentication attempts. If exploited, this could cause accounEPSS 0.4%CVE-2025-36758MEDIUMBypass of bruteforce protection in SolaX CloudEPSS 0.4%CVE-2025-56224HIGHA lack of rate limiting in the One-Time Password (OTP) verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification viEPSS 0.4%CVE-2026-16347HIGHImproper restriction of excessive authentication attempts in MikroTik RouterOS and Cloud Hosted RouterEPSS 0.4%CVE-2025-62257MEDIUMPassword enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 throEPSS 0.4%CVE-2026-108109CRITICALPHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset CodeEPSS 0.4%CVE-2026-48084HIGHOpenReception doesn't rate limit passphrase login attemptsEPSS 0.4%CVE-2026-32729HIGHRuntipi has a TOTP two-factor authentication bypass via unrestricted brute-force on `/api/auth/verify-totp`EPSS 0.4%CVE-2025-46414CRITICALEG4 Electronics EG4 Inverters Improper Restriction of Excessive Authentication AttemptsEPSS 0.4%CVE-2026-61458HIGHPasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottled EndpointEPSS 0.4%CVE-2026-105638CRITICALPlane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute forceEPSS 0.4%CVE-2025-49186MEDIUMNo brute-force protectionEPSS 0.4%CVE-2025-24806LOWRegulation applies separately to Username-based logins to Email-based logins in autheliaEPSS 0.4%CVE-2025-46739HIGHImproper Restriction of Excessive Authentication AttemptsEPSS 0.4%CVE-2026-86729CRITICALWWBN AVideo Unrestricted Authentication Attempts via get_api_preauthorizeEPSS 0.4%CVE-2023-48276MEDIUMWordPress WP Forms Puzzle Captcha plugin <= 4.1 - Captcha Bypass vulnerabilityEPSS 0.4%CVE-2026-55501HIGH9router: Login brute-force protection bypass via spoofed X-Forwarded-For headerEPSS 0.4%CVE-2026-1409LOWBeetel 777VR1 UART excessive authenticationEPSS 0.4%