Falhas do tipo CWE-307

545 resultados

Falta de proteção contra tentativas excessivas de autenticação

A aplicação não limita ou não desacelera tentativas de login, permitindo que um atacante teste múltiplas credenciais rapidamente (força bruta, dicionário ou spray de senhas). Sem controle, a conta fica vulnerável a comprometimento, especialmente se senhas fracas forem usadas.

Exemplo

Um endpoint de login que aceita 10 mil requisições por segundo sem nenhuma restrição. Um atacante automatiza tentativas com senhas comuns contra mil usuários até acertar credenciais válidas em poucos minutos.

Como mitigar

Implemente rate limiting (máximo de tentativas por IP/usuário em período curto), atrasos progressivos (backoff exponencial) após falhas, bloqueio temporário de conta após N tentativas, e idealmente autenticação multifator para reduzir o dano de senhas comprometidas.

CVE-2026-27801MEDIUMVaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit EnforcementEPSS 0.3%CVE-2026-56592MEDIUMHCL BigFix Service Management is affected by multiple security vulnerabilities.EPSS 0.3%CVE-2026-111056MEDIUMFOSSBilling: Unauthenticated client account enumeration via guest signup endpointEPSS 0.3%CVE-2025-36363MEDIUMIBM DevOps Plan is vulnerable to Excessive Authentication AttemptsEPSS 0.3%CVE-2026-15079MEDIUMLogin Disable - Moderately critical - Access bypass - SA-CONTRIB-2026-070EPSS 0.3%CVE-2026-27521MEDIUMBinardat 10G08-0800GSM Network Switch Missing Login Rate LimitingEPSS 0.3%CVE-2026-33879LOWFLIP doesn't have rate limiting or brute-force protection on loginEPSS 0.3%CVE-2025-26862NONEPingFederate unexpected browser flow initiation in redirectless modeEPSS 0.3%CVE-2026-18318MEDIUMIBM i Information DisclosureEPSS 0.3%CVE-2026-77057LOWImproper Restriction of Excessive Authentication Attempts in boneIOEPSS 0.3%CVE-2026-34505MEDIUMOpenClaw < 2026.3.12 - Webhook Rate Limiting Bypass via Pre-Authentication Secret ValidationEPSS 0.3%CVE-2025-3129MEDIUMAccess code - Moderately critical - Access bypass - SA-CONTRIB-2025-028EPSS 0.3%CVE-2025-7630MEDIUMOTP Password Brute Forcing in DorukNet's WispotterEPSS 0.3%CVE-2026-2402MEDIUMCWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to gain access to the usEPSS 0.3%CVE-2025-65427MEDIUMAn issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version V1.0.0 does not implement rate limiting to EPSS 0.3%CVE-2026-107256MEDIUMShield - Moderately critical - Access bypass - SA-CONTRIB-2026-248EPSS 0.3%CVE-2026-111886HIGHphpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor EndpointEPSS 0.3%CVE-2026-62850MEDIUMFreeScout: Administrative tools.php endpoint is accessible to low-privileged users, enabling filesystem enumeration and unthrottled brute-force of application secretsEPSS 0.3%CVE-2026-76779HIGHDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Excessive AuthenticationEPSS 0.3%CVE-2025-55003MEDIUMOpenBao Login MFA Bypasses Rate Limiting and TOTP Token ReuseEPSS 0.3%