Falhas do tipo CWE-307

545 resultados

Falta de proteção contra tentativas excessivas de autenticação

A aplicação não limita ou não desacelera tentativas de login, permitindo que um atacante teste múltiplas credenciais rapidamente (força bruta, dicionário ou spray de senhas). Sem controle, a conta fica vulnerável a comprometimento, especialmente se senhas fracas forem usadas.

Exemplo

Um endpoint de login que aceita 10 mil requisições por segundo sem nenhuma restrição. Um atacante automatiza tentativas com senhas comuns contra mil usuários até acertar credenciais válidas em poucos minutos.

Como mitigar

Implemente rate limiting (máximo de tentativas por IP/usuário em período curto), atrasos progressivos (backoff exponencial) após falhas, bloqueio temporário de conta após N tentativas, e idealmente autenticação multifator para reduzir o dano de senhas comprometidas.

CVE-2026-15144HIGH@fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotationEPSS 0.4%CVE-2024-28833MEDIUMMissing brute-force protection for two factor authenticationEPSS 0.4%CVE-2024-9928MEDIUMA vulnerability exists in NSD570 login panel that does not restrict excessive authentication attempts. If exploited, this could cause accounEPSS 0.4%CVE-2025-36758MEDIUMBypass of bruteforce protection in SolaX CloudEPSS 0.4%CVE-2025-56224HIGHA lack of rate limiting in the One-Time Password (OTP) verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification viEPSS 0.4%CVE-2026-16347HIGHImproper restriction of excessive authentication attempts in MikroTik RouterOS and Cloud Hosted RouterEPSS 0.4%CVE-2025-62257MEDIUMPassword enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 throEPSS 0.4%CVE-2026-108109CRITICALPHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset CodeEPSS 0.4%CVE-2026-48084HIGHOpenReception doesn't rate limit passphrase login attemptsEPSS 0.4%CVE-2026-32729HIGHRuntipi has a TOTP two-factor authentication bypass via unrestricted brute-force on `/api/auth/verify-totp`EPSS 0.4%CVE-2025-46414CRITICALEG4 Electronics EG4 Inverters Improper Restriction of Excessive Authentication AttemptsEPSS 0.4%CVE-2026-61458HIGHPasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottled EndpointEPSS 0.4%CVE-2026-105638CRITICALPlane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute forceEPSS 0.4%CVE-2025-49186MEDIUMNo brute-force protectionEPSS 0.4%CVE-2025-24806LOWRegulation applies separately to Username-based logins to Email-based logins in autheliaEPSS 0.4%CVE-2025-46739HIGHImproper Restriction of Excessive Authentication AttemptsEPSS 0.4%CVE-2026-86729CRITICALWWBN AVideo Unrestricted Authentication Attempts via get_api_preauthorizeEPSS 0.4%CVE-2023-48276MEDIUMWordPress WP Forms Puzzle Captcha plugin <= 4.1 - Captcha Bypass vulnerabilityEPSS 0.4%CVE-2026-55501HIGH9router: Login brute-force protection bypass via spoofed X-Forwarded-For headerEPSS 0.4%CVE-2026-1409LOWBeetel 777VR1 UART excessive authenticationEPSS 0.4%