Weaknesses of type CWE-307

545 results

Falta de Proteção contra Tentativas Excessivas de Autenticação

É a ausência de mecanismos que limitam o número de tentativas de login ou autenticação em um curto período. Um atacante pode fazer força bruta (testar muitas senhas ou códigos) sem ser bloqueado, permitindo descobrir credenciais válidas ou contornar fatores de autenticação como OTP.

Example

Um sistema de login não bloqueia a conta após 5 tentativas erradas nem implementa delay progressivo. Um atacante automático testa 10 mil combinações de senha em minutos contra um usuário-alvo e consegue acesso. Ou um atacante bruta-força códigos de 2FA sem que o sistema limite as tentativas.

How to mitigate

Implemente bloqueio ou throttling: limitar tentativas (ex: máx 5 por minuto), aumentar delay entre tentativas, bloquear conta temporariamente após falhas consecutivas, usar CAPTCHA após N tentativas, e registrar/alertar sobre picos de tentativas suspeitas.

CVE-2026-27801MEDIUMVaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit EnforcementEPSS 0.3%CVE-2026-56592MEDIUMHCL BigFix Service Management is affected by multiple security vulnerabilities.EPSS 0.3%CVE-2026-111056MEDIUMFOSSBilling: Unauthenticated client account enumeration via guest signup endpointEPSS 0.3%CVE-2025-36363MEDIUMIBM DevOps Plan is vulnerable to Excessive Authentication AttemptsEPSS 0.3%CVE-2026-15079MEDIUMLogin Disable - Moderately critical - Access bypass - SA-CONTRIB-2026-070EPSS 0.3%CVE-2026-27521MEDIUMBinardat 10G08-0800GSM Network Switch Missing Login Rate LimitingEPSS 0.3%CVE-2026-33879LOWFLIP doesn't have rate limiting or brute-force protection on loginEPSS 0.3%CVE-2025-26862NONEPingFederate unexpected browser flow initiation in redirectless modeEPSS 0.3%CVE-2026-18318MEDIUMIBM i Information DisclosureEPSS 0.3%CVE-2026-77057LOWImproper Restriction of Excessive Authentication Attempts in boneIOEPSS 0.3%CVE-2026-34505MEDIUMOpenClaw < 2026.3.12 - Webhook Rate Limiting Bypass via Pre-Authentication Secret ValidationEPSS 0.3%CVE-2025-3129MEDIUMAccess code - Moderately critical - Access bypass - SA-CONTRIB-2025-028EPSS 0.3%CVE-2025-7630MEDIUMOTP Password Brute Forcing in DorukNet's WispotterEPSS 0.3%CVE-2026-2402MEDIUMCWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to gain access to the usEPSS 0.3%CVE-2025-65427MEDIUMAn issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version V1.0.0 does not implement rate limiting to EPSS 0.3%CVE-2026-107256MEDIUMShield - Moderately critical - Access bypass - SA-CONTRIB-2026-248EPSS 0.3%CVE-2026-111886HIGHphpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor EndpointEPSS 0.3%CVE-2026-62850MEDIUMFreeScout: Administrative tools.php endpoint is accessible to low-privileged users, enabling filesystem enumeration and unthrottled brute-force of application secretsEPSS 0.3%CVE-2026-76779HIGHDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Excessive AuthenticationEPSS 0.3%CVE-2025-55003MEDIUMOpenBao Login MFA Bypasses Rate Limiting and TOTP Token ReuseEPSS 0.3%