Falhas do tipo CWE-307

534 resultados

Falta de proteção contra tentativas excessivas de autenticação

A aplicação não limita ou não desacelera tentativas de login, permitindo que um atacante teste múltiplas credenciais rapidamente (força bruta, dicionário ou spray de senhas). Sem controle, a conta fica vulnerável a comprometimento, especialmente se senhas fracas forem usadas.

Exemplo

Um endpoint de login que aceita 10 mil requisições por segundo sem nenhuma restrição. Um atacante automatiza tentativas com senhas comuns contra mil usuários até acertar credenciais válidas em poucos minutos.

Como mitigar

Implemente rate limiting (máximo de tentativas por IP/usuário em período curto), atrasos progressivos (backoff exponencial) após falhas, bloqueio temporário de conta após N tentativas, e idealmente autenticação multifator para reduzir o dano de senhas comprometidas.

CVE-2026-20792HIGHChargemap chargemap.com Improper Restriction of Excessive Authentication AttemptsEPSS 0.6%CVE-2026-24445HIGHEV Energy ev.energy Improper Restriction of Excessive Authentication AttemptsEPSS 0.6%CVE-2023-3548HIGHIQ Wifi 6EPSS 0.5%CVE-2023-42480MEDIUMInformation Disclosure in NetWeaver AS Java LogonEPSS 0.5%CVE-2024-46442CRITICALAn issue in the BYD Dilink Headunit System v3.0 to v4.0 allows attackers to bypass authentication via a bruteforce attack.EPSS 0.5%CVE-2022-38491HIGHAn issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. Part of the application does not implement protection against brute-fEPSS 0.5%CVE-2025-48187CRITICALRAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification cEPSS 0.5%CVE-2026-37603MEDIUMImproper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder (pH7 Social Dating CMS) throEPSS 0.5%CVE-2026-13348MEDIUMCWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized acEPSS 0.5%CVE-2023-32657MEDIUMWeintek Weincloud Improper Restriction of Excessive Authentication AttemptsEPSS 0.5%CVE-2024-8462MEDIUMWindmill HTTP Request users.rs excessive authenticationEPSS 0.5%CVE-2026-25114HIGHCloudCharge cloudcharge.se Improper Restriction of Excessive Authentication AttemptsEPSS 0.5%CVE-2025-52997MEDIUMFile Browser Insecurely Handles PasswordsEPSS 0.5%CVE-2026-25113HIGHSWITCH EV swtchenergy.com Improper Restriction of Excessive Authentication AttemptsEPSS 0.5%CVE-2026-26305HIGHMobility46 mobility46.se Improper Restriction of Excessive Authentication AttemptsEPSS 0.5%CVE-2024-41904HIGHA vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application do not prEPSS 0.5%CVE-2023-54347HIGHOpenEMR 7.0.1 Authentication Brute Force Mitigation BypassEPSS 0.5%CVE-2026-42952HIGHHydro-Québec Le Circuit Electrique charging station backend Improper Restriction of Excessive Authentication AttemptsEPSS 0.5%CVE-2026-111675CRITICALCourse-tencent-cloud through 2.0.1 Verification Code Brute Force Account TakeoverEPSS 0.5%CVE-2024-21500MEDIUMAll versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Restriction of Excessive Authentication Attempts vEPSS 0.5%