Falhas do tipo CWE-307

484 resultados

Falta de proteção contra tentativas excessivas de autenticação

A aplicação não limita ou não desacelera tentativas de login, permitindo que um atacante teste múltiplas credenciais rapidamente (força bruta, dicionário ou spray de senhas). Sem controle, a conta fica vulnerável a comprometimento, especialmente se senhas fracas forem usadas.

Exemplo

Um endpoint de login que aceita 10 mil requisições por segundo sem nenhuma restrição. Um atacante automatiza tentativas com senhas comuns contra mil usuários até acertar credenciais válidas em poucos minutos.

Como mitigar

Implemente rate limiting (máximo de tentativas por IP/usuário em período curto), atrasos progressivos (backoff exponencial) após falhas, bloqueio temporário de conta após N tentativas, e idealmente autenticação multifator para reduzir o dano de senhas comprometidas.

CVE-2026-55501HIGH9router: Login brute-force protection bypass via spoofed X-Forwarded-For headerEPSS 0.5%CVE-2026-33152CRITICALTandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthenticationEPSS 0.5%CVE-2024-30390MEDIUMJunos OS Evolved: Connection limits is not being enforced while the resp. rate limit is being enforcedEPSS 0.5%CVE-2025-36064MEDIUMIBM Sterling Connect:Express for Microsoft Windows information disclosureEPSS 0.5%CVE-2026-62862CRITICALTypeBot: Account takeover via brute-forceable 6-digit magic-link codeEPSS 0.5%CVE-2024-47656CRITICALUser Enumeration vulnerabilityEPSS 0.5%CVE-2023-49278MEDIUMUmbraco CMS brute force exploit can be used to collect valid usernamesEPSS 0.5%CVE-2026-91972HIGHVikunja before 2.6.0 Authentication Bypass via Unthrottled APIEPSS 0.5%CVE-2026-78655CRITICALPunk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the sessionEPSS 0.5%CVE-2023-5754CRITICALImproper Restriction of Excessive Authentication Attempts in Sielco PolyEco1000EPSS 0.5%CVE-2025-10761MEDIUMHarness Login Endpoint login excessive authenticationEPSS 0.5%CVE-2025-63807CRITICALAn issue was discovered in weijiang1994 university-bbs (aka Blogin) in commit 9e06bab430bfc729f27b4284ba7570db3b11ce84 (2025-01-13). A weak EPSS 0.5%CVE-2025-64526MEDIUMStrapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keyingEPSS 0.5%CVE-2025-58587MEDIUMImproper Restriction of Excessive Authentication AttemptsEPSS 0.5%CVE-2025-25595CRITICALA lack of rate limiting in the login page of Safe App version a3.0.9 allows attackers to bypass authentication via a brute force attack.EPSS 0.5%CVE-2026-32295CRITICALJetKVM insufficient login rate limitingEPSS 0.5%CVE-2026-24445HIGHEV Energy ev.energy Improper Restriction of Excessive Authentication AttemptsEPSS 0.5%CVE-2026-77561MEDIUMTinyauth: Unauthenticated login attempts can trigger global login lockdown denial of serviceEPSS 0.5%CVE-2026-19898MEDIUMVictoriaMetrics VMAuth Authentication Endpoint main.go requestHandler excessive authenticationEPSS 0.5%CVE-2025-5864MEDIUMTenda TDSEE App Password Reset Confirmation Code ConfirmSmsCode excessive authenticationEPSS 0.5%