Falhas do tipo CWE-307

545 resultados

Falta de proteção contra tentativas excessivas de autenticação

A aplicação não limita ou não desacelera tentativas de login, permitindo que um atacante teste múltiplas credenciais rapidamente (força bruta, dicionário ou spray de senhas). Sem controle, a conta fica vulnerável a comprometimento, especialmente se senhas fracas forem usadas.

Exemplo

Um endpoint de login que aceita 10 mil requisições por segundo sem nenhuma restrição. Um atacante automatiza tentativas com senhas comuns contra mil usuários até acertar credenciais válidas em poucos minutos.

Como mitigar

Implemente rate limiting (máximo de tentativas por IP/usuário em período curto), atrasos progressivos (backoff exponencial) após falhas, bloqueio temporário de conta após N tentativas, e idealmente autenticação multifator para reduzir o dano de senhas comprometidas.

CVE-2025-4383CRITICALAuthentication Bypass in Art-In Systems' Wi-Fi Cloud HotspotEPSS 0.4%CVE-2024-5682MEDIUMUser Enumeration in Yordam Information Technology's Yordam Library Automation SystemEPSS 0.4%CVE-2025-6015MEDIUMVault Login MFA Bypass of Rate Limiting and TOTP Code ReuseEPSS 0.4%CVE-2026-103977HIGHFileRise: Session-scoped TOTP rate limiting permits repeated verification attemptsEPSS 0.4%CVE-2026-35623MEDIUMOpenClaw < 2026.3.25 - Brute-Force Attack via Missing Webhook Password Rate LimitingEPSS 0.4%CVE-2023-48290MEDIUMWordPress Form Maker by 10Web plugin <= 1.15.20 - Captcha Bypass Vulnerability vulnerabilityEPSS 0.4%CVE-2024-35747MEDIUMWordPress Contact Form Builder, Contact Widget plugin <= 2.1.7 - Bypass Vulnerability vulnerabilityEPSS 0.4%CVE-2023-23730MEDIUMWordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Captcha Bypass VulnerabilityEPSS 0.4%CVE-2026-40538LOWAn improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager (DSM) before 7.2.1-EPSS 0.4%CVE-2026-33580MEDIUMOpenClaw < 2026.3.28 - Brute Force Attack via Missing Rate Limiting on Webhook Shared Secret AuthenticationEPSS 0.4%CVE-2025-64102HIGHZitadel allows brute-forcing authentication factorsEPSS 0.4%CVE-2026-116007MEDIUMYunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authenticationEPSS 0.4%CVE-2025-9551MEDIUMProtected Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-101EPSS 0.4%CVE-2026-105866MEDIUMPayload: Unauthenticated account-lockout denial of serviceEPSS 0.4%CVE-2026-69193MEDIUMFileRise: Rate Limiting Bypass via Username Rotation Enables Unlimited Password SprayingEPSS 0.4%CVE-2025-46606MEDIUMDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain an improper restEPSS 0.4%CVE-2026-40586HIGHblueprintUE: Login Endpoint Has No Rate Limiting, Lockout, or Brute-Force ProtectionEPSS 0.4%CVE-2025-1714MEDIUMUsername Enumeration in GliffyEPSS 0.4%CVE-2026-107638HIGHpH7Builder before 18.5.0 2FA Brute Force via VerificationCodeFormProcess.phpEPSS 0.4%CVE-2026-11779MEDIUMPayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock accessEPSS 0.4%