Falhas do tipo CWE-307

541 resultados

Falta de proteção contra tentativas excessivas de autenticação

A aplicação não limita ou não desacelera tentativas de login, permitindo que um atacante teste múltiplas credenciais rapidamente (força bruta, dicionário ou spray de senhas). Sem controle, a conta fica vulnerável a comprometimento, especialmente se senhas fracas forem usadas.

Exemplo

Um endpoint de login que aceita 10 mil requisições por segundo sem nenhuma restrição. Um atacante automatiza tentativas com senhas comuns contra mil usuários até acertar credenciais válidas em poucos minutos.

Como mitigar

Implemente rate limiting (máximo de tentativas por IP/usuário em período curto), atrasos progressivos (backoff exponencial) após falhas, bloqueio temporário de conta após N tentativas, e idealmente autenticação multifator para reduzir o dano de senhas comprometidas.

CVE-2026-61611HIGHLychee: Missing rate limiting on album password unlock endpoint allows brute-force attacksEPSS 0.5%CVE-2026-71213CRITICALtypemill - No Rate Limiting on Login Endpoint Enables Unlimited Password Brute-ForceEPSS 0.5%CVE-2026-102334CRITICALNginx Proxy Manager through 2.16.0 Missing Brute-Force ProtectionEPSS 0.5%CVE-2026-47203LOWAuthelia Missing Username Canonicalization in Basic Auth (LDAP)EPSS 0.5%CVE-2024-3102MEDIUMJSON Injection in mintplex-labs/anything-llmEPSS 0.5%CVE-2026-3329HIGHNexus Repository Manager - Improper Restriction of Excessive Authentication AttemptsEPSS 0.4%CVE-2026-76213CRITICALphpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped ThrottleEPSS 0.4%CVE-2026-111356CRITICALMacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-ForceEPSS 0.4%CVE-2025-11566MEDIUMCWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network toEPSS 0.4%CVE-2026-82644HIGHWWBN AVideo Brute-force Rate Limiting Bypass via Missing User-AgentEPSS 0.4%CVE-2023-41270LOWSamsung Smart TV UE40D7000 WPS DoS attackEPSS 0.4%CVE-2025-1740CRITICALAuthentication Bypass in Akinsoft's MyRezztaEPSS 0.4%CVE-2024-39873HIGHA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly imEPSS 0.4%CVE-2024-41682MEDIUMA vulnerability has been identified in Location Intelligence family (All versions < V4.4). Affected products do not properly enforce restricEPSS 0.4%CVE-2026-31904HIGHCTEK Chargeportal Improper Restriction of Excessive Authentication AttemptsEPSS 0.4%CVE-2022-34389LOW Dell SupportAssist contains a rate limit bypass issues in screenmeet API third party component. An unauthenticated attacker could potentialEPSS 0.4%CVE-2025-48014HIGHImproper Restriction of Excessive Authentication AttemptsEPSS 0.4%CVE-2025-2417HIGHOTP Bypass in Akinsoft's e-MutabakatEPSS 0.4%CVE-2025-2411HIGHOTP Bypass in Akinsoft's TaskPanoEPSS 0.4%CVE-2026-119746HIGHProSoft ICX35 Login Lockout Bypass via Client-Side CookiesEPSS 0.4%