Weaknesses of type CWE-307

484 results

Falta de Proteção contra Tentativas Excessivas de Autenticação

É a ausência de mecanismos que limitam o número de tentativas de login ou autenticação em um curto período. Um atacante pode fazer força bruta (testar muitas senhas ou códigos) sem ser bloqueado, permitindo descobrir credenciais válidas ou contornar fatores de autenticação como OTP.

Example

Um sistema de login não bloqueia a conta após 5 tentativas erradas nem implementa delay progressivo. Um atacante automático testa 10 mil combinações de senha em minutos contra um usuário-alvo e consegue acesso. Ou um atacante bruta-força códigos de 2FA sem que o sistema limite as tentativas.

How to mitigate

Implemente bloqueio ou throttling: limitar tentativas (ex: máx 5 por minuto), aumentar delay entre tentativas, bloquear conta temporariamente após falhas consecutivas, usar CAPTCHA após N tentativas, e registrar/alertar sobre picos de tentativas suspeitas.

CVE-2026-11915MEDIUMBrute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047EPSS 0.3%CVE-2024-24721MEDIUMAn issue was discovered on Innovaphone PBX before 14r1 devices. The password form, used to authenticate, allows a Brute Force Attack throughEPSS 0.3%CVE-2024-47592MEDIUMInformation Disclosure Vulnerability in SAP NetWeaver Application Server Java (Logon Application)EPSS 0.3%CVE-2022-40903MEDIUMAiphone GT-DMB-N 3-in-1 Video Entrance Station with NFC Reader 1.0.3 does not mitigate against repeated failed access attempts, which allowsEPSS 0.3%CVE-2025-7882LOWMercusys MW301R Login excessive authenticationEPSS 0.3%CVE-2026-73045HIGHSiYuan before 3.7.4 Brute-Force via authFilePublishAccessEPSS 0.3%CVE-2026-40586HIGHblueprintUE: Login Endpoint Has No Rate Limiting, Lockout, or Brute-Force ProtectionEPSS 0.3%CVE-2025-2514MEDIUMImproper Restriction of Excessive Authentication Attempts vulnerability in Hitachi Virtual Storage PlatformEPSS 0.3%CVE-2026-73529MEDIUMPlainpad Missing Rate Limiting via POST /v1/sessionsEPSS 0.3%CVE-2024-53647MEDIUMTrend Micro ID Security, version 3.0 and below contains a vulnerability that could allow an attacker to send an unlimited number of email veEPSS 0.3%CVE-2025-52916LOWYealink RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force enumeration (last five digits).EPSS 0.3%CVE-2026-35597MEDIUMVikunja Affected by TOTP Brute-Force Due to Non-Functional Account LockoutEPSS 0.3%CVE-2026-33667HIGHOpenProject: 2FA OTP Verification Missing Rate LimitingEPSS 0.3%CVE-2026-55795MEDIUMCraft Commerce: Coupon Code Brute-Force via Rate Limit BypassEPSS 0.3%CVE-2025-57815LOWFides Lacks Brute-Force Protections on Authentication EndpointsEPSS 0.3%CVE-2026-45364HIGHBetter Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotationEPSS 0.3%CVE-2024-11126LOWDigistar AG-30 Plus Login Page excessive authenticationEPSS 0.3%CVE-2026-78490HIGHDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper RestrictEPSS 0.3%CVE-2026-43914HIGHVaultwarden: Brute-force protection bypass vulnerabilityEPSS 0.3%CVE-2026-26227MEDIUMVLC for Android < 3.7.0 Remote Access OTP Authentication BypassEPSS 0.3%