Weaknesses of type CWE-307

545 results

Falta de Proteção contra Tentativas Excessivas de Autenticação

É a ausência de mecanismos que limitam o número de tentativas de login ou autenticação em um curto período. Um atacante pode fazer força bruta (testar muitas senhas ou códigos) sem ser bloqueado, permitindo descobrir credenciais válidas ou contornar fatores de autenticação como OTP.

Example

Um sistema de login não bloqueia a conta após 5 tentativas erradas nem implementa delay progressivo. Um atacante automático testa 10 mil combinações de senha em minutos contra um usuário-alvo e consegue acesso. Ou um atacante bruta-força códigos de 2FA sem que o sistema limite as tentativas.

How to mitigate

Implemente bloqueio ou throttling: limitar tentativas (ex: máx 5 por minuto), aumentar delay entre tentativas, bloquear conta temporariamente após falhas consecutivas, usar CAPTCHA após N tentativas, e registrar/alertar sobre picos de tentativas suspeitas.

CVE-2026-91973HIGHVikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuthEPSS 0.7%CVE-2023-40706HIGHImproper Restriction of Excessive Authentication Attempts in OPTO 22 SNAP PAC S1 Built-in Web ServerEPSS 0.7%CVE-2023-49810HIGHA login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb.EPSS 0.7%CVE-2026-27778HIGHePower epower.ie Improper Restriction of Excessive Authentication AttemptsEPSS 0.7%CVE-2023-45191HIGHIBM Engineering Lifecycle Optimization information disclosureEPSS 0.7%CVE-2023-50326HIGHIBM PowerSC information DisclosureEPSS 0.7%CVE-2026-65894HIGHImproper Authentication Vulnerability in CP PLUS EZ-P21 IP CameraEPSS 0.7%CVE-2023-33868MEDIUMPiiGAB M-Bus Improper Restriction of Excessive Authentication AttemptsEPSS 0.7%CVE-2023-0860HIGHImproper Restriction of Excessive Authentication Attempts in modoboa/modoboa-installerEPSS 0.7%CVE-2023-33754MEDIUMThe captive portal in Inpiazza Cloud WiFi versions prior to v4.2.17 does not enforce limits on the number of attempts for password recovery,EPSS 0.7%CVE-2026-75773MEDIUMkarakeep-app karakeep Login Endpoint auth.ts authorize excessive authenticationEPSS 0.7%CVE-2024-42466CRITICALLack of resources and rate limiting - loginEPSS 0.7%CVE-2026-78551HIGHRansomLook Login Endpoint Allows Timing-Based Username Enumeration and Unthrottled Authentication AttemptsEPSS 0.6%CVE-2022-23746HIGHThe IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender (SNX). If the portal is configured foEPSS 0.6%CVE-2023-24020HIGH Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior could bypass the brute force protection, allowing multiple attempts to force a loEPSS 0.6%CVE-2025-8742MEDIUMmacrozheng mall Admin Login excessive authenticationEPSS 0.6%CVE-2023-0574MEDIUMServer-Side Request ForgeryEPSS 0.6%CVE-2022-32515HIGHA CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause brute force attacks to take over EPSS 0.6%CVE-2026-91972HIGHVikunja before 2.6.0 Authentication Bypass via Unthrottled APIEPSS 0.6%CVE-2024-43042CRITICALPluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack.EPSS 0.6%