Weaknesses of type CWE-307

545 results

Falta de Proteção contra Tentativas Excessivas de Autenticação

É a ausência de mecanismos que limitam o número de tentativas de login ou autenticação em um curto período. Um atacante pode fazer força bruta (testar muitas senhas ou códigos) sem ser bloqueado, permitindo descobrir credenciais válidas ou contornar fatores de autenticação como OTP.

Example

Um sistema de login não bloqueia a conta após 5 tentativas erradas nem implementa delay progressivo. Um atacante automático testa 10 mil combinações de senha em minutos contra um usuário-alvo e consegue acesso. Ou um atacante bruta-força códigos de 2FA sem que o sistema limite as tentativas.

How to mitigate

Implemente bloqueio ou throttling: limitar tentativas (ex: máx 5 por minuto), aumentar delay entre tentativas, bloquear conta temporariamente após falhas consecutivas, usar CAPTCHA após N tentativas, e registrar/alertar sobre picos de tentativas suspeitas.

CVE-2026-93637LOWZimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate LimitingEPSS 0.3%CVE-2026-84461MEDIUMZammad: Missing rate limiting allows password brute-forcing during two-factor loginEPSS 0.3%CVE-2026-16619HIGHminiOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor AttemptsEPSS 0.3%CVE-2025-2911MEDIUMImproper Restriction of Excessive Authentication Attempts vulnerability in MeetMe productsEPSS 0.3%CVE-2024-38488MEDIUMDell RecoverPoint for Virtual Machines 6.0.x contains a vulnerability. An improper Restriction of Excessive Authentication vulnerability wheEPSS 0.3%CVE-2026-97363HIGHMonta monta.app Improper Restriction of Excessive Authentication AttemptsEPSS 0.3%CVE-2022-40903MEDIUMAiphone GT-DMB-N 3-in-1 Video Entrance Station with NFC Reader 1.0.3 does not mitigate against repeated failed access attempts, which allowsEPSS 0.3%CVE-2026-22616MEDIUMEaton Intelligent Power Protector (IPP) software allows repeated authentication attempts against the web interface login page due to insuffiEPSS 0.3%CVE-2024-51720MEDIUMVulnerabilities in SecuSUITE Server Components Impact SecuSUITEEPSS 0.3%CVE-2026-25577HIGHEmmett has an Unhandled CookieError Exception Causing Denial of ServiceEPSS 0.3%CVE-2026-44195MEDIUMOPNsense: Authentication lockout bypassEPSS 0.3%CVE-2026-105835CRITICALPLANKA 2.2.0 through 2.2.1 TOTP Brute Force via verify-totp EndpointEPSS 0.3%CVE-2026-47380MEDIUMNocoDB: User Enumeration via Sign-In TimingEPSS 0.3%CVE-2023-48318MEDIUMWordPress Contact Form Email plugin <= 1.3.41 - Captcha Bypass vulnerabilityEPSS 0.3%CVE-2024-53647MEDIUMTrend Micro ID Security, version 3.0 and below contains a vulnerability that could allow an attacker to send an unlimited number of email veEPSS 0.3%CVE-2026-11915MEDIUMBrute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047EPSS 0.3%CVE-2026-35597MEDIUMVikunja Affected by TOTP Brute-Force Due to Non-Functional Account LockoutEPSS 0.3%CVE-2024-24721MEDIUMAn issue was discovered on Innovaphone PBX before 14r1 devices. The password form, used to authenticate, allows a Brute Force Attack throughEPSS 0.3%CVE-2025-57815LOWFides Lacks Brute-Force Protections on Authentication EndpointsEPSS 0.3%CVE-2024-47592MEDIUMInformation Disclosure Vulnerability in SAP NetWeaver Application Server Java (Logon Application)EPSS 0.3%