Falhas do tipo CWE-307

545 resultados

Falta de proteção contra tentativas excessivas de autenticação

A aplicação não limita ou não desacelera tentativas de login, permitindo que um atacante teste múltiplas credenciais rapidamente (força bruta, dicionário ou spray de senhas). Sem controle, a conta fica vulnerável a comprometimento, especialmente se senhas fracas forem usadas.

Exemplo

Um endpoint de login que aceita 10 mil requisições por segundo sem nenhuma restrição. Um atacante automatiza tentativas com senhas comuns contra mil usuários até acertar credenciais válidas em poucos minutos.

Como mitigar

Implemente rate limiting (máximo de tentativas por IP/usuário em período curto), atrasos progressivos (backoff exponencial) após falhas, bloqueio temporário de conta após N tentativas, e idealmente autenticação multifator para reduzir o dano de senhas comprometidas.

CVE-2025-28172MEDIUMGrandstream Networks UCM6510 v1.0.20.52 and before is vulnerable to Improper Restriction of Excessive Authentication Attempts. An attacker cEPSS 0.3%CVE-2026-107145MEDIUMLack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticatorEPSS 0.3%CVE-2026-92082MEDIUMPayara Server is vulnerable to brute-force login attacks due to the absence of a limit on failed login attemptsEPSS 0.3%CVE-2026-92583MEDIUMAVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter IncrementEPSS 0.3%CVE-2026-86186MEDIUMAVideo API Rate Limit Bypass via Bot User-Agent HeaderEPSS 0.3%CVE-2025-2514MEDIUMImproper Restriction of Excessive Authentication Attempts vulnerability in Hitachi Virtual Storage PlatformEPSS 0.3%CVE-2026-100678HIGHstoatchat before 0.15.5 MFA Brute Force via Insufficient Rate LimitingEPSS 0.3%CVE-2026-35628MEDIUMOpenClaw < 2026.3.25 - Brute-Force Attack via Missing Telegram Webhook Rate LimitingEPSS 0.3%CVE-2026-27981HIGHHomeBox has an Auth Rate Limit Bypass via IP SpoofingEPSS 0.3%CVE-2025-59113MEDIUMBruteforce Protection Bypass in Windu CMSEPSS 0.3%CVE-2025-52916LOWYealink RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force enumeration (last five digits).EPSS 0.3%CVE-2026-43847HIGHA vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even wheEPSS 0.3%CVE-2026-33667HIGHOpenProject: 2FA OTP Verification Missing Rate LimitingEPSS 0.3%CVE-2026-45364HIGHBetter Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotationEPSS 0.3%CVE-2026-21755MEDIUMHCL Hive is affected by a missing rate limitEPSS 0.3%CVE-2024-11126LOWDigistar AG-30 Plus Login Page excessive authenticationEPSS 0.3%CVE-2026-100501HIGHFlame through 2.4.0 Brute-Force Attack via Login EndpointEPSS 0.3%CVE-2026-19877HIGHBrute-forceable image-share link password in INFINITT ULiteEPSS 0.3%CVE-2025-10161HIGHAuthentication Bypass in Turkguven's PerfektiveEPSS 0.3%CVE-2026-43914HIGHVaultwarden: Brute-force protection bypass vulnerabilityEPSS 0.3%