CWE-307: Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Consequences

• Access Control: Bypass Protection Mechanism

How to prevent it

• Architecture and Design: Common protection mechanisms include: Disconnecting the user after a small number of failed attempts Implementing a timeout Locking out a targeted account Requiring a computational task on the user's part.
• Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]

Recent advisories

• GHSA-653j-g8j7-gh54 — ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing
• GHSA-44jh-23m7-hpcf — @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL
• GHSA-v5gf-vpjc-pc7w — Payload: Unauthenticated account-lockout denial of service
• GHSA-g6xm-f9xp-qq35 — Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path
• GHSA-32gc-64m7-hj7v — 9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header
• GHSA-m469-88xx-8rx2 — Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords
• GHSA-6rvj-qwjf-3m4q — Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited
• GHSA-7cfm-pqrj-xgq7 — 9router: Login brute-force protection bypass via spoofed X-Forwarded-For header
• GHSA-jg8r-5jh2-v2xj — Payload CMS default account-unlock access allows authenticated users to reset other accounts' lockouts
• GHSA-jr54-jwhj-55gp — NocoDB: User Enumeration via Sign-In Timing
• GHSA-w5r6-mcgq-7pq4 — Yamcs has No Rate Limiting on Authentication Endpoint
• GHSA-w9xh-5f39-vq89 — phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration
• GHSA-p6v2-xcpg-h6xw — Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation
• GHSA-hv9p-2pqf-r5w3 — pgAdmin 4: Improper restriction of excessive authentication attempts
• GHSA-9pq7-mfwh-xx2j — phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id

All advisories for CWE-307