Falhas do tipo CWE-307

484 resultados

Falta de proteção contra tentativas excessivas de autenticação

A aplicação não limita ou não desacelera tentativas de login, permitindo que um atacante teste múltiplas credenciais rapidamente (força bruta, dicionário ou spray de senhas). Sem controle, a conta fica vulnerável a comprometimento, especialmente se senhas fracas forem usadas.

Exemplo

Um endpoint de login que aceita 10 mil requisições por segundo sem nenhuma restrição. Um atacante automatiza tentativas com senhas comuns contra mil usuários até acertar credenciais válidas em poucos minutos.

Como mitigar

Implemente rate limiting (máximo de tentativas por IP/usuário em período curto), atrasos progressivos (backoff exponencial) após falhas, bloqueio temporário de conta após N tentativas, e idealmente autenticação multifator para reduzir o dano de senhas comprometidas.

CVE-2026-26227MEDIUMVLC for Android < 3.7.0 Remote Access OTP Authentication BypassEPSS 0.3%CVE-2026-15079MEDIUMLogin Disable - Moderately critical - Access bypass - SA-CONTRIB-2026-070EPSS 0.3%CVE-2025-59113MEDIUMBruteforce Protection Bypass in Windu CMSEPSS 0.3%CVE-2026-25577HIGHEmmett has an Unhandled CookieError Exception Causing Denial of ServiceEPSS 0.3%CVE-2025-10161HIGHAuthentication Bypass in Turkguven's PerfektiveEPSS 0.3%CVE-2026-85237HIGHMissing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication BypassEPSS 0.3%CVE-2026-2402MEDIUMCWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to gain access to the usEPSS 0.3%CVE-2025-65427MEDIUMAn issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version V1.0.0 does not implement rate limiting to EPSS 0.3%CVE-2026-34505MEDIUMOpenClaw < 2026.3.12 - Webhook Rate Limiting Bypass via Pre-Authentication Secret ValidationEPSS 0.3%CVE-2025-28172MEDIUMGrandstream Networks UCM6510 v1.0.20.52 and before is vulnerable to Improper Restriction of Excessive Authentication Attempts. An attacker cEPSS 0.3%CVE-2026-33879LOWFLIP doesn't have rate limiting or brute-force protection on loginEPSS 0.3%CVE-2026-16347HIGHImproper restriction of excessive authentication attempts in MikroTik RouterOS and Cloud Hosted RouterEPSS 0.3%CVE-2025-3129MEDIUMAccess code - Moderately critical - Access bypass - SA-CONTRIB-2025-028EPSS 0.3%CVE-2025-47951MEDIUMWeblate lacks rate limiting when verifying second factorEPSS 0.3%CVE-2026-82644HIGHWWBN AVideo Brute-force Rate Limiting Bypass via Missing User-AgentEPSS 0.3%CVE-2026-27981HIGHHomeBox has an Auth Rate Limit Bypass via IP SpoofingEPSS 0.3%CVE-2026-27801MEDIUMVaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit EnforcementEPSS 0.3%CVE-2026-41213MEDIUM@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codesEPSS 0.3%CVE-2026-22603MEDIUMOpenProject has no protection against brute-force attacks in the Change Password functionEPSS 0.3%CVE-2026-56592MEDIUMHCL BigFix Service Management is affected by multiple security vulnerabilities.EPSS 0.3%