Weaknesses of type CWE-307

545 results

Falta de Proteção contra Tentativas Excessivas de Autenticação

É a ausência de mecanismos que limitam o número de tentativas de login ou autenticação em um curto período. Um atacante pode fazer força bruta (testar muitas senhas ou códigos) sem ser bloqueado, permitindo descobrir credenciais válidas ou contornar fatores de autenticação como OTP.

Example

Um sistema de login não bloqueia a conta após 5 tentativas erradas nem implementa delay progressivo. Um atacante automático testa 10 mil combinações de senha em minutos contra um usuário-alvo e consegue acesso. Ou um atacante bruta-força códigos de 2FA sem que o sistema limite as tentativas.

How to mitigate

Implemente bloqueio ou throttling: limitar tentativas (ex: máx 5 por minuto), aumentar delay entre tentativas, bloquear conta temporariamente após falhas consecutivas, usar CAPTCHA após N tentativas, e registrar/alertar sobre picos de tentativas suspeitas.

CVE-2025-4383CRITICALAuthentication Bypass in Art-In Systems' Wi-Fi Cloud HotspotEPSS 0.4%CVE-2024-5682MEDIUMUser Enumeration in Yordam Information Technology's Yordam Library Automation SystemEPSS 0.4%CVE-2025-6015MEDIUMVault Login MFA Bypass of Rate Limiting and TOTP Code ReuseEPSS 0.4%CVE-2026-103977HIGHFileRise: Session-scoped TOTP rate limiting permits repeated verification attemptsEPSS 0.4%CVE-2026-35623MEDIUMOpenClaw < 2026.3.25 - Brute-Force Attack via Missing Webhook Password Rate LimitingEPSS 0.4%CVE-2023-48290MEDIUMWordPress Form Maker by 10Web plugin <= 1.15.20 - Captcha Bypass Vulnerability vulnerabilityEPSS 0.4%CVE-2024-35747MEDIUMWordPress Contact Form Builder, Contact Widget plugin <= 2.1.7 - Bypass Vulnerability vulnerabilityEPSS 0.4%CVE-2023-23730MEDIUMWordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Captcha Bypass VulnerabilityEPSS 0.4%CVE-2026-40538LOWAn improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager (DSM) before 7.2.1-EPSS 0.4%CVE-2026-33580MEDIUMOpenClaw < 2026.3.28 - Brute Force Attack via Missing Rate Limiting on Webhook Shared Secret AuthenticationEPSS 0.4%CVE-2025-64102HIGHZitadel allows brute-forcing authentication factorsEPSS 0.4%CVE-2026-116007MEDIUMYunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authenticationEPSS 0.4%CVE-2025-9551MEDIUMProtected Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-101EPSS 0.4%CVE-2026-105866MEDIUMPayload: Unauthenticated account-lockout denial of serviceEPSS 0.4%CVE-2026-69193MEDIUMFileRise: Rate Limiting Bypass via Username Rotation Enables Unlimited Password SprayingEPSS 0.4%CVE-2025-46606MEDIUMDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain an improper restEPSS 0.4%CVE-2026-40586HIGHblueprintUE: Login Endpoint Has No Rate Limiting, Lockout, or Brute-Force ProtectionEPSS 0.4%CVE-2025-1714MEDIUMUsername Enumeration in GliffyEPSS 0.4%CVE-2026-107638HIGHpH7Builder before 18.5.0 2FA Brute Force via VerificationCodeFormProcess.phpEPSS 0.4%CVE-2026-11779MEDIUMPayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock accessEPSS 0.4%