Falhas do tipo CWE-307

545 resultados

Falta de proteção contra tentativas excessivas de autenticação

A aplicação não limita ou não desacelera tentativas de login, permitindo que um atacante teste múltiplas credenciais rapidamente (força bruta, dicionário ou spray de senhas). Sem controle, a conta fica vulnerável a comprometimento, especialmente se senhas fracas forem usadas.

Exemplo

Um endpoint de login que aceita 10 mil requisições por segundo sem nenhuma restrição. Um atacante automatiza tentativas com senhas comuns contra mil usuários até acertar credenciais válidas em poucos minutos.

Como mitigar

Implemente rate limiting (máximo de tentativas por IP/usuário em período curto), atrasos progressivos (backoff exponencial) após falhas, bloqueio temporário de conta após N tentativas, e idealmente autenticação multifator para reduzir o dano de senhas comprometidas.

CVE-2026-93637LOWZimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate LimitingEPSS 0.3%CVE-2026-84461MEDIUMZammad: Missing rate limiting allows password brute-forcing during two-factor loginEPSS 0.3%CVE-2026-16619HIGHminiOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor AttemptsEPSS 0.3%CVE-2025-2911MEDIUMImproper Restriction of Excessive Authentication Attempts vulnerability in MeetMe productsEPSS 0.3%CVE-2024-38488MEDIUMDell RecoverPoint for Virtual Machines 6.0.x contains a vulnerability. An improper Restriction of Excessive Authentication vulnerability wheEPSS 0.3%CVE-2026-97363HIGHMonta monta.app Improper Restriction of Excessive Authentication AttemptsEPSS 0.3%CVE-2022-40903MEDIUMAiphone GT-DMB-N 3-in-1 Video Entrance Station with NFC Reader 1.0.3 does not mitigate against repeated failed access attempts, which allowsEPSS 0.3%CVE-2026-22616MEDIUMEaton Intelligent Power Protector (IPP) software allows repeated authentication attempts against the web interface login page due to insuffiEPSS 0.3%CVE-2024-51720MEDIUMVulnerabilities in SecuSUITE Server Components Impact SecuSUITEEPSS 0.3%CVE-2026-25577HIGHEmmett has an Unhandled CookieError Exception Causing Denial of ServiceEPSS 0.3%CVE-2026-44195MEDIUMOPNsense: Authentication lockout bypassEPSS 0.3%CVE-2026-105835CRITICALPLANKA 2.2.0 through 2.2.1 TOTP Brute Force via verify-totp EndpointEPSS 0.3%CVE-2026-47380MEDIUMNocoDB: User Enumeration via Sign-In TimingEPSS 0.3%CVE-2023-48318MEDIUMWordPress Contact Form Email plugin <= 1.3.41 - Captcha Bypass vulnerabilityEPSS 0.3%CVE-2024-53647MEDIUMTrend Micro ID Security, version 3.0 and below contains a vulnerability that could allow an attacker to send an unlimited number of email veEPSS 0.3%CVE-2026-11915MEDIUMBrute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047EPSS 0.3%CVE-2026-35597MEDIUMVikunja Affected by TOTP Brute-Force Due to Non-Functional Account LockoutEPSS 0.3%CVE-2024-24721MEDIUMAn issue was discovered on Innovaphone PBX before 14r1 devices. The password form, used to authenticate, allows a Brute Force Attack throughEPSS 0.3%CVE-2025-57815LOWFides Lacks Brute-Force Protections on Authentication EndpointsEPSS 0.3%CVE-2024-47592MEDIUMInformation Disclosure Vulnerability in SAP NetWeaver Application Server Java (Logon Application)EPSS 0.3%