Weaknesses of type CWE-307

545 results

Falta de Proteção contra Tentativas Excessivas de Autenticação

É a ausência de mecanismos que limitam o número de tentativas de login ou autenticação em um curto período. Um atacante pode fazer força bruta (testar muitas senhas ou códigos) sem ser bloqueado, permitindo descobrir credenciais válidas ou contornar fatores de autenticação como OTP.

Example

Um sistema de login não bloqueia a conta após 5 tentativas erradas nem implementa delay progressivo. Um atacante automático testa 10 mil combinações de senha em minutos contra um usuário-alvo e consegue acesso. Ou um atacante bruta-força códigos de 2FA sem que o sistema limite as tentativas.

How to mitigate

Implemente bloqueio ou throttling: limitar tentativas (ex: máx 5 por minuto), aumentar delay entre tentativas, bloquear conta temporariamente após falhas consecutivas, usar CAPTCHA após N tentativas, e registrar/alertar sobre picos de tentativas suspeitas.

CVE-2026-71205MEDIUMchangedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-ForceEPSS 0.3%CVE-2025-47951MEDIUMWeblate lacks rate limiting when verifying second factorEPSS 0.3%CVE-2026-108580MEDIUMAniWorld Downloader before 5.3.0 WebUI Login Brute Force via /loginEPSS 0.3%CVE-2026-22603MEDIUMOpenProject has no protection against brute-force attacks in the Change Password functionEPSS 0.3%CVE-2026-41213MEDIUM@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codesEPSS 0.3%CVE-2024-3461MEDIUMKioWare for Windows (versions all through 8.35) allows to brute force the PIN number, which protects the application from being closed, as tEPSS 0.3%CVE-2024-25031MEDIUMIBM Storage Defender information disclosureEPSS 0.2%CVE-2026-35646MEDIUMOpenClaw < 2026.3.25 - Pre-Authentication Rate-Limit Bypass in Webhook Token ValidationEPSS 0.2%CVE-2025-46603HIGHDell CloudBoost Virtual Appliance, versions 19.13.0.0 and prior, contains an Improper Restriction of Excessive Authentication Attempts vulneEPSS 0.2%CVE-2025-67090MEDIUMThe LuCI web interface on Gl Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. Fix available in version 4.8.2 GL.Inet AX1800 VersionEPSS 0.2%CVE-2025-1629MEDIUMExcitel Broadband Private my Excitel App One-Time Password excessive authenticationEPSS 0.2%CVE-2026-123521MEDIUMVikunja before 2.7.1 Password Brute-Force via TOTP Disable EndpointEPSS 0.2%CVE-2025-10928MEDIUMAccess code - Moderately critical - Access bypass - SA-CONTRIB-2025-108EPSS 0.2%CVE-2023-25820MEDIUMNextcloud Server and Enterprise Server missing brute force protection on password confirmation modalEPSS 0.2%CVE-2025-54998MEDIUMOpenBao Userpass and LDAP User Lockout BypassEPSS 0.2%CVE-2021-36285MEDIUMDell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administratorEPSS 0.2%CVE-2021-36284MEDIUMDell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administratorEPSS 0.2%CVE-2026-123998HIGHHisense VIDAA Smart TV MQTT Broker Authentication BypassEPSS 0.2%CVE-2024-42176LOWHCL MyXalytics is affected by concurrent login vulnerabilityEPSS 0.2%CVE-2024-2323MEDIUMPassword Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account DiscoveryEPSS 0.2%