Falhas do tipo CWE-307

540 resultados

Falta de proteção contra tentativas excessivas de autenticação

A aplicação não limita ou não desacelera tentativas de login, permitindo que um atacante teste múltiplas credenciais rapidamente (força bruta, dicionário ou spray de senhas). Sem controle, a conta fica vulnerável a comprometimento, especialmente se senhas fracas forem usadas.

Exemplo

Um endpoint de login que aceita 10 mil requisições por segundo sem nenhuma restrição. Um atacante automatiza tentativas com senhas comuns contra mil usuários até acertar credenciais válidas em poucos minutos.

Como mitigar

Implemente rate limiting (máximo de tentativas por IP/usuário em período curto), atrasos progressivos (backoff exponencial) após falhas, bloqueio temporário de conta após N tentativas, e idealmente autenticação multifator para reduzir o dano de senhas comprometidas.

CVE-2022-43377HIGH A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover when a brutEPSS 0.6%CVE-2023-29005HIGHNo Rate Limiting on Login AUTH DBEPSS 0.6%CVE-2026-19895MEDIUMopensourcepos Open Source Point of Sale Login Endpoint Filters.php index excessive authenticationEPSS 0.6%CVE-2022-2457MEDIUMA flaw was found in Red Hat Process Automation Manager 7 where an attacker can benefit from a brute force attack against Administration ConsEPSS 0.6%CVE-2023-1665HIGHImproper Restriction of Excessive Authentication Attempts in linagora/twakeEPSS 0.6%CVE-2026-65948HIGHApache Ranger: UnixAuth lacks brute-force protectionEPSS 0.6%CVE-2023-5754CRITICALImproper Restriction of Excessive Authentication Attempts in Sielco PolyEco1000EPSS 0.6%CVE-2023-1539MEDIUMImproper Restriction of Excessive Authentication Attempts in answerdev/answerEPSS 0.6%CVE-2023-50123HIGHThe number of attempts to bring the Hozard Alarm system (alarmsystemen) v1.0 to a disarmed state is not limited. This could allow an attackeEPSS 0.6%CVE-2025-54833MEDIUMOPEXUS FOIAXpress Public Access Link (PAL) account-lockout and CAPTCHA protection bypassEPSS 0.6%CVE-2026-85734CRITICALLightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force AttacksEPSS 0.6%CVE-2026-19297CRITICALInsufficient Authentication Brute Force Protection on Login EndpointEPSS 0.6%CVE-2024-39917HIGHxrdp allows an ininite number of login attemptsEPSS 0.6%CVE-2025-11441MEDIUMJhumanJ OpnForm HTTP Header excessive authenticationEPSS 0.6%CVE-2025-27449HIGHCVE-2025-27449EPSS 0.6%CVE-2025-1710HIGHCVE-2025-1710EPSS 0.6%CVE-2025-27456HIGHCVE-2025-27456EPSS 0.6%CVE-2023-25818MEDIUMMissing brute force protection on password reset token in Nextcloud ServerEPSS 0.6%CVE-2026-77561MEDIUMTinyauth: Unauthenticated login attempts can trigger global login lockdown denial of serviceEPSS 0.6%CVE-2023-46745MEDIUMRate limiting Bypass on login page in libreNMSEPSS 0.6%