Falhas do tipo CWE-307

541 resultados

Falta de proteção contra tentativas excessivas de autenticação

A aplicação não limita ou não desacelera tentativas de login, permitindo que um atacante teste múltiplas credenciais rapidamente (força bruta, dicionário ou spray de senhas). Sem controle, a conta fica vulnerável a comprometimento, especialmente se senhas fracas forem usadas.

Exemplo

Um endpoint de login que aceita 10 mil requisições por segundo sem nenhuma restrição. Um atacante automatiza tentativas com senhas comuns contra mil usuários até acertar credenciais válidas em poucos minutos.

Como mitigar

Implemente rate limiting (máximo de tentativas por IP/usuário em período curto), atrasos progressivos (backoff exponencial) após falhas, bloqueio temporário de conta após N tentativas, e idealmente autenticação multifator para reduzir o dano de senhas comprometidas.

CVE-2026-69183HIGHMonkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)EPSS 0.5%CVE-2023-34001MEDIUMWordPress Hide My WP Ghost – Security Plugin plugin <= 5.0.25 - Captcha Bypass vulnerabilityEPSS 0.5%CVE-2025-66204MEDIUMWBCE CMS allows brute-force protection bypass using X-Forwarded-For headerEPSS 0.5%CVE-2024-9342MEDIUMIn Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of faEPSS 0.5%CVE-2025-2171HIGHAviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversEPSS 0.5%CVE-2026-33640CRITICALOutline has a rate limit bypass that allows brute force of email login OTPEPSS 0.5%CVE-2023-26271MEDIUMIBM Security Guardium Data Encryption information disclosureEPSS 0.5%CVE-2024-42465CRITICALLack of resources and rate limiting - two factor authenticationEPSS 0.5%CVE-2024-32774MEDIUMWordPress ProfileGrid plugin <= 5.8.2 - Group Members Limit Bypass vulnerabilityEPSS 0.5%CVE-2025-43863LOWvantage6 lacks brute-force protection on change password functionalityEPSS 0.5%CVE-2025-6004MEDIUMVault Userpass and LDAP User Lockout BypassEPSS 0.5%CVE-2025-42600HIGHBrute Force Attack Vulnerability in Meon KYC solutionsEPSS 0.5%CVE-2026-24436CRITICALTenda W30E V2 Lacks Rate Limiting on AuthenticationEPSS 0.5%CVE-2025-67853HIGHMoodle: moodle: brute-force facilitation due to missing rate limiting in confirmation email serviceEPSS 0.5%CVE-2024-0787MEDIUMImproper Restriction of Excessive Authentication Attempts in phpipam/phpipamEPSS 0.5%CVE-2024-22425MEDIUMDell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains a brute force/dictionary attack vulnerability. An unauthenticated remote attaEPSS 0.5%CVE-2026-85237HIGHMissing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication BypassEPSS 0.5%CVE-2024-32868MEDIUMZITADEL's Improper Lockout Mechanism Leads to MFA BypassEPSS 0.5%CVE-2026-33419CRITICALMinIO: LDAP login brute-force via user enumeration and missing rate limitEPSS 0.5%CVE-2024-5862HIGHUser Enumeration in Mia Technology's Mia-Med Health AplicationEPSS 0.5%