Falhas do tipo CWE-307

541 resultados

Falta de proteção contra tentativas excessivas de autenticação

A aplicação não limita ou não desacelera tentativas de login, permitindo que um atacante teste múltiplas credenciais rapidamente (força bruta, dicionário ou spray de senhas). Sem controle, a conta fica vulnerável a comprometimento, especialmente se senhas fracas forem usadas.

Exemplo

Um endpoint de login que aceita 10 mil requisições por segundo sem nenhuma restrição. Um atacante automatiza tentativas com senhas comuns contra mil usuários até acertar credenciais válidas em poucos minutos.

Como mitigar

Implemente rate limiting (máximo de tentativas por IP/usuário em período curto), atrasos progressivos (backoff exponencial) após falhas, bloqueio temporário de conta após N tentativas, e idealmente autenticação multifator para reduzir o dano de senhas comprometidas.

CVE-2024-47656CRITICALUser Enumeration vulnerabilityEPSS 0.5%CVE-2025-69615CRITICALIncorrect Access Control via missing 2FA rate-limiting allowing unlimited brute-force retries and full MFA bypass with no user interaction rEPSS 0.5%CVE-2026-76940HIGHEbyte NA111-M Improper Restriction of Excessive Authentication AttemptsEPSS 0.5%CVE-2025-25595CRITICALA lack of rate limiting in the login page of Safe App version a3.0.9 allows attackers to bypass authentication via a brute force attack.EPSS 0.5%CVE-2025-5864MEDIUMTenda TDSEE App Password Reset Confirmation Code ConfirmSmsCode excessive authenticationEPSS 0.5%CVE-2026-46649CRITICALJoplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected EndpointEPSS 0.5%CVE-2023-49278MEDIUMUmbraco CMS brute force exploit can be used to collect valid usernamesEPSS 0.5%CVE-2026-78490HIGHDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper RestrictEPSS 0.5%CVE-2026-56682MEDIUM9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip HeaderEPSS 0.5%CVE-2026-20882HIGHMobiliti e-mobi.hu Improper Restriction of Excessive Authentication AttemptsEPSS 0.5%CVE-2026-78655CRITICALPunk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the sessionEPSS 0.5%CVE-2026-110770CRITICALDatabasus 3.7.0 through 3.61.0 Account Takeover via Password Reset Brute-ForceEPSS 0.5%CVE-2025-10761MEDIUMHarness Login Endpoint login excessive authenticationEPSS 0.5%CVE-2023-32251LOWKernel: ksmbd brute force delay bypass via asynchronous requestsEPSS 0.5%CVE-2025-64526MEDIUMStrapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keyingEPSS 0.5%CVE-2022-26964HIGHWeak password derivation for export in Devolutions Remote Desktop Manager before 2022.1 allows information disclosure via a password brute-fEPSS 0.5%CVE-2025-58587MEDIUMImproper Restriction of Excessive Authentication AttemptsEPSS 0.5%CVE-2023-45009MEDIUMWordPress Captcha for Contact Form 7 plugin <= 1.11.3 - Capcha Bypass vulnerabilityEPSS 0.5%CVE-2026-111874MEDIUMOpenCATS Career Portal CareersUI.php processLogin excessive authenticationEPSS 0.5%CVE-2025-64310CRITICALEPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products do not restrict excessive authentication attempts. An administrativEPSS 0.5%