Common Weakness Enumeration
CWE-307
Weakness AllowedImproper Restriction of Excessive Authentication Attempts
Abstraction: Base · Status: Draft
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
Mapping guidance
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Relationships and members
Modes of introduction
Architecture and Design
COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.
Detection methods
Dynamic Analysis with Automated Results Interpretation
According to SOAR [REF-1479], the following detection techniques may be useful:
Highly cost effective:
Web Application Scanner
Web Services Scanner
Database Scanners
Cost effective for partial coverage:
Host-based Vulnerability Scanners - Examine configuration for flaws, verifying that audit mechanisms work, ensure host configuration meets certain predefined criteria
Effectiveness: High
Dynamic Analysis with Manual Results Interpretation
According to SOAR [REF-1479], the following detection techniques may be useful:
Highly cost effective:
Fuzz Tester
Framework-based Fuzzer
Cost effective for partial coverage:
Forced Path Execution
Effectiveness: High
Manual Static Analysis - Source Code
According to SOAR [REF-1479], the following detection techniques may be useful:
Highly cost effective:
Focused Manual Spotcheck - Focused manual analysis of source
Manual Source Code Review (not inspections)
Effectiveness: High
Automated Static Analysis - Source Code
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Source code Weakness Analyzer
Context-configured Source Code Weakness Analyzer
Effectiveness: SOAR Partial
Automated Static Analysis
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Configuration Checker
Effectiveness: SOAR Partial
Architecture or Design Review
According to SOAR [REF-1479], the following detection techniques may be useful:
Highly cost effective:
Formal Methods / Correct-By-Construction
Cost effective for partial coverage:
Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)
Effectiveness: High
Content history
Submission: PLOVER
· 2006-07-19
· CWE Draft 3
Contribution: Abhi Balakrishnan
· 2024-09-10
· CWE 4.16
Contributed usability diagram concepts used by the CWE team
Modification: Sean Eidemiller
· Cigital
· 2008-07-01
· CWE 1.0
added/updated demonstrative examples
Modification: CWE Content Team
· MITRE
· 2008-09-08
· CWE 1.0
updated Relationships, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2009-03-10
· CWE 1.3
updated Relationships
Modification: CWE Content Team
· MITRE
· 2009-07-27
· CWE 1.5
updated Observed_Examples
Modification: CWE Content Team
· MITRE
· 2009-12-28
· CWE 1.7
updated Applicable_Platforms, Demonstrative_Examples, Potential_Mitigations
Modification: CWE Content Team
· MITRE
· 2010-02-16
· CWE 1.8
updated Demonstrative_Examples, Name, Potential_Mitigations, Relationships, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2010-04-05
· CWE 1.8.1
updated Demonstrative_Examples
Modification: CWE Content Team
· MITRE
· 2011-03-29
· CWE 1.12
updated Demonstrative_Examples
Modification: CWE Content Team
· MITRE
· 2011-06-01
· CWE 1.13
updated Common_Consequences
Modification: CWE Content Team
· MITRE
· 2011-06-27
· CWE 2.0
updated Common_Consequences, Related_Attack_Patterns, Relationships
Modification: CWE Content Team
· MITRE
· 2011-09-13
· CWE 2.1
updated Potential_Mitigations, References, Relationships
Modification: CWE Content Team
· MITRE
· 2012-05-11
· CWE 2.2
updated Relationships
Modification: CWE Content Team
· MITRE
· 2014-07-30
· CWE 2.8
updated Detection_Factors, Relationships, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2017-11-08
· CWE 3.0
updated Demonstrative_Examples, Modes_of_Introduction, Relationships
Modification: CWE Content Team
· MITRE
· 2019-06-20
· CWE 3.3
updated Demonstrative_Examples, Relationships
Modification: CWE Content Team
· MITRE
· 2020-02-24
· CWE 4.0
updated Detection_Factors, Relationships
Modification: CWE Content Team
· MITRE
· 2020-08-20
· CWE 4.2
updated Related_Attack_Patterns
Modification: CWE Content Team
· MITRE
· 2021-10-28
· CWE 4.6
updated Demonstrative_Examples, References, Relationships
Modification: CWE Content Team
· MITRE
· 2022-10-13
· CWE 4.9
updated Demonstrative_Examples, Description, Observed_Examples, References, Relationships
Modification: CWE Content Team
· MITRE
· 2023-04-27
· CWE 4.11
updated Demonstrative_Examples, References, Relationships
Modification: CWE Content Team
· MITRE
· 2023-06-29
· CWE 4.12
updated Mapping_Notes
Modification: CWE Content Team
· MITRE
· 2024-11-19
· CWE 4.16
updated Common_Consequences, Description, Diagram
Modification: CWE Content Team
· MITRE
· 2025-09-09
· CWE 4.18
updated Demonstrative_Examples, Detection_Factors, Potential_Mitigations, References
Modification: CWE Content Team
· MITRE
· 2025-12-11
· CWE 4.19
updated Relationships, Weakness_Ordinalities
Modification: CWE Content Team
· MITRE
· 2026-10-28
· CWE 5.0
updated Applicable_Platforms, Demonstrative_Examples, References, Relationships, Taxonomy_Mappings
1125 vulnerabilities reference this CWE, most recent first.
CVE-2026-124575 (GCVE-0-2026-124575)
Vulnerability from cvelistv5 – Published: 2026-11-09 06:45 – Updated: 2026-11-09 06:45 X_Open Source
VLAI
EPSS
VEX
Title
SiteServer SSCMS Admin-Login CAPTCHA LoginController.Submit.cs LoginController.Submit excessive authentication
Summary
A vulnerability was identified in SiteServer SSCMS up to 7.1.3/7.2.1/7.4.0. This issue affects the function LoginController.Submit of the file src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs of the component Admin-Login CAPTCHA. Such manipulation of the argument isForceLogoutAndLogin leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The name of the patch is df3becb7ebb00a48435418a44fd08a459eb38ace. Applying a patch is advised to resolve this issue.
Severity
CWE
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/432921 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/432921/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124575 | third-party-advisory |
| https://vuldb.com/submit/1038068 | third-party-advisory |
| https://github.com/siteserver/cms/blob/15144f30c6… | related |
| https://github.com/siteserver/cms/pull/3905 | issue-trackingpatch |
| https://github.com/siteserver/cms/commit/df3becb7… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SiteServer | SSCMS |
Affected:
7.0
Affected: 7.1 Affected: 7.1.0 Affected: 7.1.1 Affected: 7.1.2 Affected: 7.1.3 Affected: 7.2 Affected: 7.2.0 Affected: 7.2.1 Affected: 7.3 Affected: 7.4.0 cpe:2.3:a:sscms:sscms:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:sscms:sscms:*:*:*:*:*:*:*:*"
],
"modules": [
"Admin-Login CAPTCHA"
],
"product": "SSCMS",
"vendor": "SiteServer",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"status": "affected",
"version": "7.1"
},
{
"status": "affected",
"version": "7.1.0"
},
{
"status": "affected",
"version": "7.1.1"
},
{
"status": "affected",
"version": "7.1.2"
},
{
"status": "affected",
"version": "7.1.3"
},
{
"status": "affected",
"version": "7.2"
},
{
"status": "affected",
"version": "7.2.0"
},
{
"status": "affected",
"version": "7.2.1"
},
{
"status": "affected",
"version": "7.3"
},
{
"status": "affected",
"version": "7.4.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "The_S7s (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in SiteServer SSCMS up to 7.1.3/7.2.1/7.4.0. This issue affects the function LoginController.Submit of the file src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs of the component Admin-Login CAPTCHA. Such manipulation of the argument isForceLogoutAndLogin leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The name of the patch is df3becb7ebb00a48435418a44fd08a459eb38ace. Applying a patch is advised to resolve this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-799",
"description": "Improper Control of Interaction Frequency",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T06:45:19.896Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-432921 | SiteServer SSCMS Admin-Login CAPTCHA LoginController.Submit.cs LoginController.Submit excessive authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/432921"
},
{
"name": "VDB-432921 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/432921/cti"
},
{
"name": "CVE-2026-124575 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124575"
},
{
"name": "Submit #1038068 | siteserver SiteServer CMS (SSCMS) 7.4.0 Improper Restriction of Excessive Authentication Attempts",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1038068"
},
{
"tags": [
"related"
],
"url": "https://github.com/siteserver/cms/blob/15144f30c6cc0e11d50985b6ab9236cfce8cacbd/src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs#L46"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/siteserver/cms/pull/3905"
},
{
"tags": [
"patch"
],
"url": "https://github.com/siteserver/cms/commit/df3becb7ebb00a48435418a44fd08a459eb38ace"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-08T18:03:03.000Z",
"value": "VulDB entry last update"
}
],
"title": "SiteServer SSCMS Admin-Login CAPTCHA LoginController.Submit.cs LoginController.Submit excessive authentication",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124575",
"datePublished": "2026-11-09T06:45:19.896Z",
"dateReserved": "2026-11-08T16:57:48.423Z",
"dateUpdated": "2026-11-09T06:45:19.896Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124445 (GCVE-0-2026-124445)
Vulnerability from cvelistv5 – Published: 2026-11-08 13:15 – Updated: 2026-11-08 13:15
VLAI
EPSS
VEX
Title
OpenEMR 7.0.1 before 8.4.0 OneTimeAuth Token Replay and PIN Brute Force
Summary
OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and max_access_count flags, never revokes consumed service_auth tokens, and checks login_pin without rate limiting or strict comparison. Attackers holding a captured token can replay it or brute-force the PIN to open patient-portal sessions exposing PHI.
Severity
9.8 (Critical)
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openemr/openemr/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/openemr-7.0.… | third-party-advisory |
Impacted products
Date Public
2026-09-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "openemr",
"vendor": "openemr",
"versions": [
{
"lessThan": "8.4.0",
"status": "affected",
"version": "7.0.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.4.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.4.0",
"versionStartIncluding": "7.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nora-Qiu"
},
{
"lang": "en",
"type": "finder",
"value": "CyberKareem"
}
],
"datePublic": "2026-09-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and max_access_count flags, never revokes consumed service_auth tokens, and checks login_pin without rate limiting or strict comparison. Attackers holding a captured token can replay it or brute-force the PIN to open patient-portal sessions exposing PHI."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T13:15:37.304Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-xg3m-9pfq-c8r6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openemr/openemr/security/advisories/GHSA-xg3m-9pfq-c8r6"
},
{
"name": "VulnCheck Advisory: OpenEMR 7.0.1 before 8.4.0 OneTimeAuth Token Replay and PIN Brute Force",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openemr-7.0.1-before-8.4.0-onetimeauth-token-replay-and-pin-brute-force"
}
],
"title": "OpenEMR 7.0.1 before 8.4.0 OneTimeAuth Token Replay and PIN Brute Force",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-124445",
"datePublished": "2026-11-08T13:15:37.304Z",
"dateReserved": "2026-11-08T02:14:31.305Z",
"dateUpdated": "2026-11-08T13:15:37.304Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123998 (GCVE-0-2026-123998)
Vulnerability from cvelistv5 – Published: 2026-11-06 18:59 – Updated: 2026-11-06 18:59
VLAI
EPSS
VEX
Title
Hisense VIDAA Smart TV MQTT Broker Authentication Bypass
Summary
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an authentication bypass vulnerability in its remote-control MQTT broker on TCP port 36669, which accepts publicly documented default credentials and an ineffective 4-digit pairing PIN with no rate limiting or lockout, allowing a brute force of the entire code space in about five seconds, while some actions require no pairing at all. A LAN-adjacent attacker can exploit this to inject key events, change volume, switch input sources, enumerate inputs, launch arbitrary installed applications, and monitor pairing activity, posing a significant risk in hotel deployments where untrusted LAN access is common.
Severity
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/yehia-mamdouh/Hisense-Smart-TV… | technical-descriptionexploit |
| https://www.vulncheck.com/advisories/hisense-vida… | third-party-advisory |
Impacted products
Date Public
2026-11-03 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VIDAA",
"vendor": "Hisense",
"versions": [
{
"status": "affected",
"version": "0000.01.00a.P0220",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yehia Elghaly (Mrvar0x)"
}
],
"datePublic": "2026-11-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an authentication bypass vulnerability in its remote-control MQTT broker on TCP port 36669, which accepts publicly documented default credentials and an ineffective 4-digit pairing PIN with no rate limiting or lockout, allowing a brute force of the entire code space in about five seconds, while some actions require no pairing at all. A LAN-adjacent attacker can exploit this to inject key events, change volume, switch input sources, enumerate inputs, launch arbitrary installed applications, and monitor pairing activity, posing a significant risk in hotel deployments where untrusted LAN access is common."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1392",
"description": "Use of Default Credentials",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T18:59:56.705Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description",
"exploit"
],
"url": "https://github.com/yehia-mamdouh/Hisense-Smart-TV-Security-Research"
},
{
"name": "VulnCheck Advisory: Hisense VIDAA Smart TV MQTT Broker Authentication Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-mqtt-broker-authentication-bypass"
}
],
"title": "Hisense VIDAA Smart TV MQTT Broker Authentication Bypass",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123998",
"datePublished": "2026-11-06T18:59:56.705Z",
"dateReserved": "2026-11-06T18:38:38.543Z",
"dateUpdated": "2026-11-06T18:59:56.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123521 (GCVE-0-2026-123521)
Vulnerability from cvelistv5 – Published: 2026-11-08 01:37 – Updated: 2026-11-08 01:37
VLAI
EPSS
VEX
Title
Vikunja before 2.7.1 Password Brute-Force via TOTP Disable Endpoint
Summary
Vikunja before 2.7.1 contains an improper restriction of excessive authentication attempts vulnerability that allows session holders to brute-force account passwords via unthrottled re-authentication endpoints. Attackers with a stolen session can guess the password via /user/settings/totp/disable without lockout, then disable TOTP without a code for persistent account takeover.
Severity
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/go-vikunja/vikunja/security/ad… | vendor-advisory |
| https://www.vulncheck.com/advisories/vikunja-befo… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| go-vikunja | vikunja |
Affected:
0 , < 2.7.1
(semver)
Unaffected: 2.7.1 (semver) cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* |
Date Public
2026-10-22 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/code.vikunja.io/api",
"product": "vikunja",
"vendor": "go-vikunja",
"versions": [
{
"lessThan": "2.7.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.7.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "M7Saad"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Vikunja before 2.7.1 contains an improper restriction of excessive authentication attempts vulnerability that allows session holders to brute-force account passwords via unthrottled re-authentication endpoints. Attackers with a stolen session can guess the password via /user/settings/totp/disable without lockout, then disable TOTP without a code for persistent account takeover."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T01:37:31.762Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-49pj-52x6-8gpj)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-49pj-52x6-8gpj"
},
{
"name": "VulnCheck Advisory: Vikunja before 2.7.1 Password Brute-Force via TOTP Disable Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vikunja-before-2.7.1-password-brute-force-via-totp-disable-endpoint"
}
],
"title": "Vikunja before 2.7.1 Password Brute-Force via TOTP Disable Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123521",
"datePublished": "2026-11-08T01:37:31.762Z",
"dateReserved": "2026-11-06T00:47:14.649Z",
"dateUpdated": "2026-11-08T01:37:31.762Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-122138 (GCVE-0-2026-122138)
Vulnerability from cvelistv5 – Published: 2026-11-04 20:36 – Updated: 2026-11-04 20:36
VLAI
EPSS
VEX
Title
BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 Login Rate Limit Bypass
Summary
BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vulnerability in LoginMiddleware.php that keys failed-login counters on case-sensitive usernames. Unauthenticated attackers can vary username casing against case-insensitive MySQL lookups to get extra attempts and brute-force passwords past the per-account lockout.
Severity
5.3 (Medium)
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/blueprintue/blueprintue-self-h… | vendor-advisory |
| https://github.com/blueprintue/blueprintue-self-h… | patch |
| https://github.com/blueprintue/blueprintue-self-h… | patchissue-tracking |
| https://github.com/blueprintue/blueprintue-self-h… | release-notes |
| https://github.com/blueprintue/blueprintue-self-h… | technical-description |
| https://www.vulncheck.com/advisories/blueprintue-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| blueprintue | blueprintue-self-hosted-edition |
Affected:
4.2.0 , < 4.3.4
(semver)
|
Date Public
2026-11-04 14:28
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/blueprintue/blueprintue-self-hosted-edition",
"product": "blueprintue-self-hosted-edition",
"repo": "https://github.com/blueprintue/blueprintue-self-hosted-edition",
"vendor": "blueprintue",
"versions": [
{
"lessThan": "4.3.4",
"status": "affected",
"version": "4.2.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Farhan Khan"
},
{
"lang": "en",
"type": "remediation developer",
"value": "rancoud"
}
],
"datePublic": "2026-11-04T14:28:24.000Z",
"descriptions": [
{
"lang": "en",
"value": "BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vulnerability in LoginMiddleware.php that keys failed-login counters on case-sensitive usernames. Unauthenticated attackers can vary username casing against case-insensitive MySQL lookups to get extra attempts and brute-force passwords past the per-account lockout."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:36:55.818Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-773r-585g-6vc3)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-773r-585g-6vc3"
},
{
"tags": [
"patch"
],
"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/bd4af38d2f7d499be23fc4106f93980a1348ddd7"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/267"
},
{
"name": "blueprintue-self-hosted-edition v4.3.4 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.4"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.3/app/middlewares/LoginMiddleware.php#L119-L158"
},
{
"name": "VulnCheck Advisory: BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 Login Rate Limit Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-4.2.0-before-4.3.4-login-rate-limit-bypass"
}
],
"title": "BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 Login Rate Limit Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-122138",
"datePublished": "2026-11-04T20:36:55.818Z",
"dateReserved": "2026-11-04T18:13:13.223Z",
"dateUpdated": "2026-11-04T20:36:55.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-122049 (GCVE-0-2026-122049)
Vulnerability from cvelistv5 – Published: 2026-11-04 23:15 – Updated: 2026-11-05 20:29 X_Freeware
VLAI
EPSS
VEX
Title
Campcodes Bitcoin Wallet System ForgotPasswordController.php random_int excessive authentication
Summary
A flaw has been found in Campcodes Bitcoin Wallet System 1.0. This affects the function random_int of the file core/app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 20:29 UTC
CWE
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/431126 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/431126/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-122049 | third-party-advisory |
| https://vuldb.com/submit/1025182 | third-party-advisory |
| https://tracexlabs.com/releases/campcodes-bitcoin… | exploitpatch |
| https://www.campcodes.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Campcodes | Bitcoin Wallet System |
Affected:
1.0
cpe:2.3:a:campcodes:bitcoin_wallet_system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-122049",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T20:29:13.706511Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T20:29:21.838Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:campcodes:bitcoin_wallet_system:*:*:*:*:*:*:*:*"
],
"product": "Bitcoin Wallet System",
"vendor": "Campcodes",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "SanthoshKumar (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Campcodes Bitcoin Wallet System 1.0. This affects the function random_int of the file core/app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. The attack\u0027s complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-799",
"description": "Improper Control of Interaction Frequency",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T23:15:11.070Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-431126 | Campcodes Bitcoin Wallet System ForgotPasswordController.php random_int excessive authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/431126"
},
{
"name": "VDB-431126 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/431126/cti"
},
{
"name": "CVE-2026-122049 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-122049"
},
{
"name": "Submit #1025182 | CampCodes CampCodes Bitcoin Wallet System n/a Authentication Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1025182"
},
{
"tags": [
"exploit",
"patch"
],
"url": "https://tracexlabs.com/releases/campcodes-bitcoin-wallet-reset-code-flaws.html"
},
{
"tags": [
"product"
],
"url": "https://www.campcodes.com/"
}
],
"tags": [
"x_freeware"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-04T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-04T17:03:56.000Z",
"value": "VulDB entry last update"
}
],
"title": "Campcodes Bitcoin Wallet System ForgotPasswordController.php random_int excessive authentication",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-122049",
"datePublished": "2026-11-04T23:15:11.070Z",
"dateReserved": "2026-11-04T15:58:50.626Z",
"dateUpdated": "2026-11-05T20:29:21.838Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121535 (GCVE-0-2026-121535)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:15 – Updated: 2026-11-04 18:56 X_Open Source
VLAI
EPSS
VEX
Title
miroslavpejic85 MiroTalk P2P Room Action server.js checkPassword excessive authentication
Summary
A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87. This vulnerability affects the function checkPassword of the file app/src/server.js of the component Room Action Handler. The manipulation results in improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been made public and could be used. Upgrading to version 2.1.38 is able to resolve this issue. The patch is identified as 55bec1d05f931d2e43633d6d0b7274f79ec719dd. Upgrading the affected component is advised.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 18:56 UTC
CWE
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/430291 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/430291/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-121535 | third-party-advisory |
| https://vuldb.com/submit/1019995 | third-party-advisory |
| https://github.com/waterhunter2000-svg/vulnerabil… | related |
| https://github.com/miroslavpejic85/mirotalk/secur… | broken-link |
| https://github.com/waterhunter2000-svg/vulnerabil… | exploit |
| https://github.com/miroslavpejic85/mirotalk/commi… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| miroslavpejic85 | MiroTalk P2P |
Affected:
2.0.0
Affected: 2.0.1 Affected: 2.0.2 Affected: 2.0.3 Affected: 2.0.4 Affected: 2.0.5 Affected: 2.0.6 Affected: 2.0.7 Affected: 2.0.8 Affected: 2.0.9 Affected: 2.0.10 Affected: 2.0.11 Affected: 2.0.12 Affected: 2.0.13 Affected: 2.0.14 Affected: 2.0.15 Affected: 2.0.16 Affected: 2.0.17 Affected: 2.0.18 Affected: 2.0.19 Affected: 2.0.20 Affected: 2.0.21 Affected: 2.0.22 Affected: 2.0.23 Affected: 2.0.24 Affected: 2.0.25 Affected: 2.0.26 Affected: 2.0.27 Affected: 2.0.28 Affected: 2.0.29 Affected: 2.0.30 Affected: 2.0.31 Affected: 2.0.32 Affected: 2.0.33 Affected: 2.0.34 Affected: 2.0.35 Affected: 2.0.36 Affected: 2.0.37 Affected: 2.0.38 Affected: 2.0.39 Affected: 2.0.40 Affected: 2.0.41 Affected: 2.0.42 Affected: 2.0.43 Affected: 2.0.44 Affected: 2.0.45 Affected: 2.0.46 Affected: 2.0.47 Affected: 2.0.48 Affected: 2.0.49 Affected: 2.0.50 Affected: 2.0.51 Affected: 2.0.52 Affected: 2.0.53 Affected: 2.0.54 Affected: 2.0.55 Affected: 2.0.56 Affected: 2.0.57 Affected: 2.0.58 Affected: 2.0.59 Affected: 2.0.60 Affected: 2.0.61 Affected: 2.0.62 Affected: 2.0.63 Affected: 2.0.64 Affected: 2.0.65 Affected: 2.0.66 Affected: 2.0.67 Affected: 2.0.68 Affected: 2.0.69 Affected: 2.0.70 Affected: 2.0.71 Affected: 2.0.72 Affected: 2.0.73 Affected: 2.0.74 Affected: 2.0.75 Affected: 2.0.76 Affected: 2.0.77 Affected: 2.0.78 Affected: 2.0.79 Affected: 2.0.80 Affected: 2.0.81 Affected: 2.0.82 Affected: 2.0.83 Affected: 2.0.84 Affected: 2.0.85 Affected: 2.0.86 Affected: 2.0.87 Unaffected: 2.1.38 cpe:2.3:a:miroslavpejic85:mirotalk_p2p:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121535",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T18:56:46.432496Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T18:56:54.511Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:miroslavpejic85:mirotalk_p2p:*:*:*:*:*:*:*:*"
],
"modules": [
"Room Action Handler"
],
"product": "MiroTalk P2P",
"vendor": "miroslavpejic85",
"versions": [
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "affected",
"version": "2.0.1"
},
{
"status": "affected",
"version": "2.0.2"
},
{
"status": "affected",
"version": "2.0.3"
},
{
"status": "affected",
"version": "2.0.4"
},
{
"status": "affected",
"version": "2.0.5"
},
{
"status": "affected",
"version": "2.0.6"
},
{
"status": "affected",
"version": "2.0.7"
},
{
"status": "affected",
"version": "2.0.8"
},
{
"status": "affected",
"version": "2.0.9"
},
{
"status": "affected",
"version": "2.0.10"
},
{
"status": "affected",
"version": "2.0.11"
},
{
"status": "affected",
"version": "2.0.12"
},
{
"status": "affected",
"version": "2.0.13"
},
{
"status": "affected",
"version": "2.0.14"
},
{
"status": "affected",
"version": "2.0.15"
},
{
"status": "affected",
"version": "2.0.16"
},
{
"status": "affected",
"version": "2.0.17"
},
{
"status": "affected",
"version": "2.0.18"
},
{
"status": "affected",
"version": "2.0.19"
},
{
"status": "affected",
"version": "2.0.20"
},
{
"status": "affected",
"version": "2.0.21"
},
{
"status": "affected",
"version": "2.0.22"
},
{
"status": "affected",
"version": "2.0.23"
},
{
"status": "affected",
"version": "2.0.24"
},
{
"status": "affected",
"version": "2.0.25"
},
{
"status": "affected",
"version": "2.0.26"
},
{
"status": "affected",
"version": "2.0.27"
},
{
"status": "affected",
"version": "2.0.28"
},
{
"status": "affected",
"version": "2.0.29"
},
{
"status": "affected",
"version": "2.0.30"
},
{
"status": "affected",
"version": "2.0.31"
},
{
"status": "affected",
"version": "2.0.32"
},
{
"status": "affected",
"version": "2.0.33"
},
{
"status": "affected",
"version": "2.0.34"
},
{
"status": "affected",
"version": "2.0.35"
},
{
"status": "affected",
"version": "2.0.36"
},
{
"status": "affected",
"version": "2.0.37"
},
{
"status": "affected",
"version": "2.0.38"
},
{
"status": "affected",
"version": "2.0.39"
},
{
"status": "affected",
"version": "2.0.40"
},
{
"status": "affected",
"version": "2.0.41"
},
{
"status": "affected",
"version": "2.0.42"
},
{
"status": "affected",
"version": "2.0.43"
},
{
"status": "affected",
"version": "2.0.44"
},
{
"status": "affected",
"version": "2.0.45"
},
{
"status": "affected",
"version": "2.0.46"
},
{
"status": "affected",
"version": "2.0.47"
},
{
"status": "affected",
"version": "2.0.48"
},
{
"status": "affected",
"version": "2.0.49"
},
{
"status": "affected",
"version": "2.0.50"
},
{
"status": "affected",
"version": "2.0.51"
},
{
"status": "affected",
"version": "2.0.52"
},
{
"status": "affected",
"version": "2.0.53"
},
{
"status": "affected",
"version": "2.0.54"
},
{
"status": "affected",
"version": "2.0.55"
},
{
"status": "affected",
"version": "2.0.56"
},
{
"status": "affected",
"version": "2.0.57"
},
{
"status": "affected",
"version": "2.0.58"
},
{
"status": "affected",
"version": "2.0.59"
},
{
"status": "affected",
"version": "2.0.60"
},
{
"status": "affected",
"version": "2.0.61"
},
{
"status": "affected",
"version": "2.0.62"
},
{
"status": "affected",
"version": "2.0.63"
},
{
"status": "affected",
"version": "2.0.64"
},
{
"status": "affected",
"version": "2.0.65"
},
{
"status": "affected",
"version": "2.0.66"
},
{
"status": "affected",
"version": "2.0.67"
},
{
"status": "affected",
"version": "2.0.68"
},
{
"status": "affected",
"version": "2.0.69"
},
{
"status": "affected",
"version": "2.0.70"
},
{
"status": "affected",
"version": "2.0.71"
},
{
"status": "affected",
"version": "2.0.72"
},
{
"status": "affected",
"version": "2.0.73"
},
{
"status": "affected",
"version": "2.0.74"
},
{
"status": "affected",
"version": "2.0.75"
},
{
"status": "affected",
"version": "2.0.76"
},
{
"status": "affected",
"version": "2.0.77"
},
{
"status": "affected",
"version": "2.0.78"
},
{
"status": "affected",
"version": "2.0.79"
},
{
"status": "affected",
"version": "2.0.80"
},
{
"status": "affected",
"version": "2.0.81"
},
{
"status": "affected",
"version": "2.0.82"
},
{
"status": "affected",
"version": "2.0.83"
},
{
"status": "affected",
"version": "2.0.84"
},
{
"status": "affected",
"version": "2.0.85"
},
{
"status": "affected",
"version": "2.0.86"
},
{
"status": "affected",
"version": "2.0.87"
},
{
"status": "unaffected",
"version": "2.1.38"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "waterhunter (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87. This vulnerability affects the function checkPassword of the file app/src/server.js of the component Room Action Handler. The manipulation results in improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been made public and could be used. Upgrading to version 2.1.38 is able to resolve this issue. The patch is identified as 55bec1d05f931d2e43633d6d0b7274f79ec719dd. Upgrading the affected component is advised."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-799",
"description": "Improper Control of Interaction Frequency",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:15:19.841Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-430291 | miroslavpejic85 MiroTalk P2P Room Action server.js checkPassword excessive authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/430291"
},
{
"name": "VDB-430291 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/430291/cti"
},
{
"name": "CVE-2026-121535 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-121535"
},
{
"name": "Submit #1019995 | miroslavpejic85 MiroTalk P2P 2.0.87 Improper Authentication",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1019995"
},
{
"tags": [
"related"
],
"url": "https://github.com/waterhunter2000-svg/vulnerability-reports"
},
{
"tags": [
"broken-link"
],
"url": "https://github.com/miroslavpejic85/mirotalk/security/advisories/GHSA-x2r2-j5hf-hp36"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/waterhunter2000-svg/vulnerability-reports/blob/main/04-mirotalk-checkpassword-oracle.md"
},
{
"tags": [
"patch"
],
"url": "https://github.com/miroslavpejic85/mirotalk/commit/55bec1d05f931d2e43633d6d0b7274f79ec719dd"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-03T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-03T15:43:37.000Z",
"value": "VulDB entry last update"
}
],
"title": "miroslavpejic85 MiroTalk P2P Room Action server.js checkPassword excessive authentication",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-121535",
"datePublished": "2026-11-03T22:15:19.841Z",
"dateReserved": "2026-11-03T14:34:55.076Z",
"dateUpdated": "2026-11-04T18:56:54.511Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119746 (GCVE-0-2026-119746)
Vulnerability from cvelistv5 – Published: 2026-11-04 15:39 – Updated: 2026-11-04 18:12
VLAI
EPSS
VEX
Title
ProSoft ICX35 Login Lockout Bypass via Client-Side Cookies
Summary
ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and continue submitting password guesses by deleting the relevant browser cookies, defeating the brute-force protection. This vulnerability has been addressed in version 1.14.158.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 18:12 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://assets.belden.com/asset/3be80067-b211-423… | vendor-advisorypatch |
| https://www.vulncheck.com/advisories/prosoft-icx3… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ProSoft Technology | X35-HWC-A |
Affected:
0 , ≤ 1.14.153
(semver)
Unaffected: 1.14.158 (semver) |
|
| ProSoft Technology | ICX35-HWC-E |
Affected:
0 , ≤ 1.14.153
(semver)
Unaffected: 1.14.158 (semver) |
Date Public
2026-10-28 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119746",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T18:12:42.577598Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T18:12:53.697Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "X35-HWC-A",
"vendor": "ProSoft Technology",
"versions": [
{
"lessThanOrEqual": "1.14.153",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.14.158",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ICX35-HWC-E",
"vendor": "ProSoft Technology",
"versions": [
{
"lessThanOrEqual": "1.14.153",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.14.158",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Rustam Amin"
}
],
"datePublic": "2026-10-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and continue submitting password guesses by deleting the relevant browser cookies, defeating the brute-force protection. This vulnerability has been addressed in version 1.14.158."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-602",
"description": "Client-Side Enforcement of Server-Side Security",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T15:39:12.767Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Belden Security Advisory",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://assets.belden.com/asset/3be80067-b211-423d-9be4-4e31bd43fbc9/PSIRT-9-Login-Lockout-Resets-in-ICX35.pdf"
},
{
"name": "VulnCheck Advisory: ProSoft ICX35 Login Lockout Bypass via Client-Side Cookies",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/prosoft-icx35-login-lockout-bypass-via-client-side-cookies"
}
],
"title": "ProSoft ICX35 Login Lockout Bypass via Client-Side Cookies",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119746",
"datePublished": "2026-11-04T15:39:12.767Z",
"dateReserved": "2026-10-30T15:31:52.079Z",
"dateUpdated": "2026-11-04T18:12:53.697Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118505 (GCVE-0-2026-118505)
Vulnerability from cvelistv5 – Published: 2026-11-03 15:47 – Updated: 2026-11-03 17:48
VLAI
EPSS
VEX
Title
AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resource
Summary
Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ash_authentication allows an unauthenticated attacker to guess passwords and one-time passwords without limit.
The password, magic link and OTP strategies enforce brute_force_strategy by adding a preparation only to the actions they generate. When the resource defines one of those actions itself, the strategy uses it as written and nothing checked that it carried the preparation, so the setting compiled and applied no limit. The generators produce exactly this: mix ash_authentication.install writes sign_in_with_password, request_password_reset_token and request_magic_link, mix ash_authentication.upgrade then adds brute_force_strategy to those strategies, and mix ash_authentication.add_strategy.otp writes its OTP actions without the preparation. Separately, with registration_enabled? true the OTP sign-in is a create action, which preparations do not run on, so brute_force_strategy {:preparation, module} never applied to it.
This issue affects ash_authentication: from 5.0.0-rc.4 before 5.0.0-rc.16.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 17:47 UTC
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/team-alembic/ash_authenticatio… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-118505.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-118505 | related |
| https://github.com/team-alembic/ash_authenticatio… | related |
| https://github.com/team-alembic/ash_authenticatio… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| team-alembic | ash_authentication |
Affected:
5.0.0-rc.4 , < 5.0.0-rc.16
(semver)
cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:* |
|
| team-alembic | ash_authentication |
Affected:
800caa0d4a5bee1f28ad427f4c12fab72003a577 , < 7117b5da5b73ee4cdb372e4adfbaff409b527125
(git)
cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118505",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T17:47:46.366690Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T17:48:03.096Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Strategy.Password.Transformer\u0027",
"\u0027Elixir.AshAuthentication.Strategy.MagicLink.Verifier\u0027",
"\u0027Elixir.AshAuthentication.Strategy.Otp.Verifier\u0027",
"\u0027Elixir.Mix.Tasks.AshAuthentication.AddStrategy.Otp\u0027"
],
"packageName": "ash_authentication",
"packageURL": "pkg:hex/ash_authentication",
"product": "ash_authentication",
"programFiles": [
"lib/ash_authentication/strategies/password/transformer.ex",
"lib/ash_authentication/strategies/magic_link/verifier.ex",
"lib/ash_authentication/strategies/otp/verifier.ex",
"lib/mix/tasks/ash_authentication.add_strategy.otp.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Strategy.Password.Transformer\u0027:transform/2"
},
{
"name": "\u0027Elixir.AshAuthentication.Strategy.MagicLink.Verifier\u0027:verify/2"
},
{
"name": "\u0027Elixir.AshAuthentication.Strategy.Otp.Verifier\u0027:verify/2"
},
{
"name": "\u0027Elixir.Mix.Tasks.AshAuthentication.AddStrategy.Otp\u0027:igniter/1"
}
],
"repo": "https://github.com/team-alembic/ash_authentication",
"vendor": "team-alembic",
"versions": [
{
"lessThan": "5.0.0-rc.16",
"status": "affected",
"version": "5.0.0-rc.4",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Strategy.Password.Transformer\u0027",
"\u0027Elixir.AshAuthentication.Strategy.MagicLink.Verifier\u0027",
"\u0027Elixir.AshAuthentication.Strategy.Otp.Verifier\u0027",
"\u0027Elixir.Mix.Tasks.AshAuthentication.AddStrategy.Otp\u0027"
],
"packageName": "team-alembic/ash_authentication",
"packageURL": "pkg:github/team-alembic/ash_authentication",
"product": "ash_authentication",
"programFiles": [
"lib/ash_authentication/strategies/password/transformer.ex",
"lib/ash_authentication/strategies/magic_link/verifier.ex",
"lib/ash_authentication/strategies/otp/verifier.ex",
"lib/mix/tasks/ash_authentication.add_strategy.otp.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Strategy.Password.Transformer\u0027:transform/2"
},
{
"name": "\u0027Elixir.AshAuthentication.Strategy.MagicLink.Verifier\u0027:verify/2"
},
{
"name": "\u0027Elixir.AshAuthentication.Strategy.Otp.Verifier\u0027:verify/2"
},
{
"name": "\u0027Elixir.Mix.Tasks.AshAuthentication.AddStrategy.Otp\u0027:igniter/1"
}
],
"repo": "https://github.com/team-alembic/ash_authentication",
"vendor": "team-alembic",
"versions": [
{
"lessThan": "7117b5da5b73ee4cdb372e4adfbaff409b527125",
"status": "affected",
"version": "800caa0d4a5bee1f28ad427f4c12fab72003a577",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA password, magic link or OTP strategy sets \u003ccode\u003ebrute_force_strategy\u003c/code\u003e and one of its protected actions (password sign-in, password reset request, magic link request, OTP sign-in or OTP request) is defined on the resource without the matching brute-force preparation, as on resources set up by the installer, the upgrade task or the OTP generator. Alternatively, an OTP strategy sets \u003ccode\u003eregistration_enabled? true\u003c/code\u003e with \u003ccode\u003ebrute_force_strategy {:preparation, module}\u003c/code\u003e. Actions the strategies generate themselves, and the OTP strategy\u0027s \u003ccode\u003e:rate_limit\u003c/code\u003e mode, are not affected.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A password, magic link or OTP strategy sets `brute_force_strategy` and one of its protected actions (password sign-in, password reset request, magic link request, OTP sign-in or OTP request) is defined on the resource without the matching brute-force preparation, as on resources set up by the installer, the upgrade task or the OTP generator. Alternatively, an OTP strategy sets `registration_enabled? true` with `brute_force_strategy {:preparation, module}`. Actions the strategies generate themselves, and the OTP strategy\u0027s `:rate_limit` mode, are not affected."
}
],
"value": "A password, magic link or OTP strategy sets brute_force_strategy and one of its protected actions (password sign-in, password reset request, magic link request, OTP sign-in or OTP request) is defined on the resource without the matching brute-force preparation, as on resources set up by the installer, the upgrade task or the OTP generator. Alternatively, an OTP strategy sets registration_enabled? true with brute_force_strategy {:preparation, module}. Actions the strategies generate themselves, and the OTP strategy\u0027s :rate_limit mode, are not affected."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.0.0-rc.16",
"versionStartIncluding": "5.0.0-rc.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "azmaveth"
},
{
"lang": "en",
"type": "reporter",
"value": "azmaveth"
},
{
"lang": "en",
"type": "remediation developer",
"value": "azmaveth"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
}
],
"dateAssigned": "2026-11-03T02:51:21.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ash_authentication allows an unauthenticated attacker to guess passwords and one-time passwords without limit.\u003c/p\u003e\n\u003cp\u003eThe password, magic link and OTP strategies enforce \u003ccode\u003ebrute_force_strategy\u003c/code\u003e by adding a preparation only to the actions they generate. When the resource defines one of those actions itself, the strategy uses it as written and nothing checked that it carried the preparation, so the setting compiled and applied no limit. The generators produce exactly this: \u003ccode\u003emix ash_authentication.install\u003c/code\u003e writes \u003ccode\u003esign_in_with_password\u003c/code\u003e, \u003ccode\u003erequest_password_reset_token\u003c/code\u003e and \u003ccode\u003erequest_magic_link\u003c/code\u003e, \u003ccode\u003emix ash_authentication.upgrade\u003c/code\u003e then adds \u003ccode\u003ebrute_force_strategy\u003c/code\u003e to those strategies, and \u003ccode\u003emix ash_authentication.add_strategy.otp\u003c/code\u003e writes its OTP actions without the preparation. Separately, with \u003ccode\u003eregistration_enabled? true\u003c/code\u003e the OTP sign-in is a create action, which preparations do not run on, so \u003ccode\u003ebrute_force_strategy {:preparation, module}\u003c/code\u003e never applied to it.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication: from 5.0.0-rc.4 before 5.0.0-rc.16.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ash_authentication allows an unauthenticated attacker to guess passwords and one-time passwords without limit.\n\nThe password, magic link and OTP strategies enforce `brute_force_strategy` by adding a preparation only to the actions they generate. When the resource defines one of those actions itself, the strategy uses it as written and nothing checked that it carried the preparation, so the setting compiled and applied no limit. The generators produce exactly this: `mix ash_authentication.install` writes `sign_in_with_password`, `request_password_reset_token` and `request_magic_link`, `mix ash_authentication.upgrade` then adds `brute_force_strategy` to those strategies, and `mix ash_authentication.add_strategy.otp` writes its OTP actions without the preparation. Separately, with `registration_enabled? true` the OTP sign-in is a create action, which preparations do not run on, so `brute_force_strategy {:preparation, module}` never applied to it.\n\nThis issue affects ash_authentication: from 5.0.0-rc.4 before 5.0.0-rc.16."
}
],
"value": "Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ash_authentication allows an unauthenticated attacker to guess passwords and one-time passwords without limit.\n\nThe password, magic link and OTP strategies enforce brute_force_strategy by adding a preparation only to the actions they generate. When the resource defines one of those actions itself, the strategy uses it as written and nothing checked that it carried the preparation, so the setting compiled and applied no limit. The generators produce exactly this: mix ash_authentication.install writes sign_in_with_password, request_password_reset_token and request_magic_link, mix ash_authentication.upgrade then adds brute_force_strategy to those strategies, and mix ash_authentication.add_strategy.otp writes its OTP actions without the preparation. Separately, with registration_enabled? true the OTP sign-in is a create action, which preparations do not run on, so brute_force_strategy {:preparation, module} never applied to it.\n\nThis issue affects ash_authentication: from 5.0.0-rc.4 before 5.0.0-rc.16."
}
],
"impacts": [
{
"capecId": "CAPEC-49",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-49 Password Brute Forcing"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307 Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T15:47:36.067Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "`brute_force_strategy` in AshAuthentication does not protect sign-in and request actions defined on the resource, allowing unlimited password and one-time password guessing",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-55gf-3263-4r39"
},
{
"name": "EEF CNA record for CVE-2026-118505",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-118505.html"
},
{
"name": "OSV record EEF-CVE-2026-118505",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-118505"
},
{
"name": "Introducing commit 800caa0 in team-alembic/ash_authentication",
"tags": [
"related"
],
"url": "https://github.com/team-alembic/ash_authentication/commit/800caa0d4a5bee1f28ad427f4c12fab72003a577"
},
{
"name": "Fix commit 7117b5d in team-alembic/ash_authentication",
"tags": [
"patch"
],
"url": "https://github.com/team-alembic/ash_authentication/commit/7117b5da5b73ee4cdb372e4adfbaff409b527125"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resource",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAdd the brute-force preparation to each protected action defined on the resource, or remove the action so the strategy generates it. For \u003ccode\u003ebrute_force_strategy {:audit_log, name}\u003c/code\u003e that is \u003ccode\u003eprepare {AshAuthentication.AddOn.AuditLog.IdentityBruteForcePreparation, action_name: \u0026lt;action\u0026gt;}\u003c/code\u003e on the password sign-in, password reset request, magic link request and OTP request actions, and \u003ccode\u003eprepare {AshAuthentication.AddOn.AuditLog.BruteForcePreparation, action_name: \u0026lt;action\u0026gt;}\u003c/code\u003e on a read OTP sign-in action. For \u003ccode\u003e{:preparation, MyModule}\u003c/code\u003e it is \u003ccode\u003eprepare MyModule\u003c/code\u003e. For OTP with \u003ccode\u003eregistration_enabled? true\u003c/code\u003e, switch to \u003ccode\u003ebrute_force_strategy :rate_limit\u003c/code\u003e.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Add the brute-force preparation to each protected action defined on the resource, or remove the action so the strategy generates it. For `brute_force_strategy {:audit_log, name}` that is `prepare {AshAuthentication.AddOn.AuditLog.IdentityBruteForcePreparation, action_name: \u003caction\u003e}` on the password sign-in, password reset request, magic link request and OTP request actions, and `prepare {AshAuthentication.AddOn.AuditLog.BruteForcePreparation, action_name: \u003caction\u003e}` on a read OTP sign-in action. For `{:preparation, MyModule}` it is `prepare MyModule`. For OTP with `registration_enabled? true`, switch to `brute_force_strategy :rate_limit`."
}
],
"value": "Add the brute-force preparation to each protected action defined on the resource, or remove the action so the strategy generates it. For brute_force_strategy {:audit_log, name} that is prepare {AshAuthentication.AddOn.AuditLog.IdentityBruteForcePreparation, action_name: \u003caction\u003e} on the password sign-in, password reset request, magic link request and OTP request actions, and prepare {AshAuthentication.AddOn.AuditLog.BruteForcePreparation, action_name: \u003caction\u003e} on a read OTP sign-in action. For {:preparation, MyModule} it is prepare MyModule. For OTP with registration_enabled? true, switch to brute_force_strategy :rate_limit."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-118505",
"datePublished": "2026-11-03T15:47:36.067Z",
"dateReserved": "2026-10-29T16:15:02.036Z",
"dateUpdated": "2026-11-03T17:48:03.096Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116238 (GCVE-0-2026-116238)
Vulnerability from cvelistv5 – Published: 2026-10-30 19:55 – Updated: 2026-11-06 16:06
VLAI
EPSS
VEX
Title
pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks
Summary
In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including the administrator's, in the default configuration:
- Flask-Security registers its own views next to pgAdmin's. A login submitted to its /login view was checked and logged in without pgAdmin's failed login count or lock. Its /verify view checked a signed-in user's password without limit, its /change view changed a password without pgAdmin's change password permission or re-encrypting the user's saved server passwords, and its /reset views sent and applied password resets for accounts that are not internal or are locked.
- The internal account was looked up by its exact username, while the login form matches the email ignoring case, so a login with the username typed in another case was neither counted nor checked for the lock.
- With LDAP or webserver authentication also configured, a wrong internal password was never counted, and with Kerberos or webserver authentication configured a guess could be answered without being counted.
In addition, where accounts from different authentication sources share an email address, a password reset could be sent for, or applied to, an account from another source, and the About box showed the server configuration to a user whose email was that of an administrator's account.
The fix refuses submissions to Flask-Security's own views, counts every failed internal login however the username is typed and whatever other sources are configured, no longer lets a login that posts a password fall back to an authentication source that does not check it, and locks only internal authentication. Password resets and the About box act only on the user's own internal account. Desktop mode is not affected.
This issue affects pgAdmin 4: before 9.19.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 16:06 UTC
CWE
Assigner
References
4 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgadmin.org | pgAdmin 4 |
Affected:
0 , < 9.19
(custom)
|
Date Public
2026-10-29 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116238",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:06:27.167452Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:06:41.395Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Authentication",
"Password Recovery",
"User Management"
],
"product": "pgAdmin 4",
"programFiles": [
"https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/__init__.py",
"https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/authenticate/__init__.py",
"https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/browser/__init__.py",
"https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/about/__init__.py"
],
"repo": "https://github.com/pgadmin-org/pgadmin4",
"vendor": "pgadmin.org",
"versions": [
{
"lessThan": "9.19",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Ashesh Vashi \u003cashesh.vashi@enterprisedb.com\u003e"
}
],
"datePublic": "2026-10-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including the administrator\u0027s, in the default configuration:\n\n- Flask-Security registers its own views next to pgAdmin\u0027s. A login submitted to its /login view was checked and logged in without pgAdmin\u0027s failed login count or lock. Its /verify view checked a signed-in user\u0027s password without limit, its /change view changed a password without pgAdmin\u0027s change password permission or re-encrypting the user\u0027s saved server passwords, and its /reset views sent and applied password resets for accounts that are not internal or are locked.\n- The internal account was looked up by its exact username, while the login form matches the email ignoring case, so a login with the username typed in another case was neither counted nor checked for the lock.\n- With LDAP or webserver authentication also configured, a wrong internal password was never counted, and with Kerberos or webserver authentication configured a guess could be answered without being counted.\n\nIn addition, where accounts from different authentication sources share an email address, a password reset could be sent for, or applied to, an account from another source, and the About box showed the server configuration to a user whose email was that of an administrator\u0027s account.\n\nThe fix refuses submissions to Flask-Security\u0027s own views, counts every failed internal login however the username is typed and whatever other sources are configured, no longer lets a login that posts a password fall back to an authentication source that does not check it, and locks only internal authentication. Password resets and the About box act only on the user\u0027s own internal account. Desktop mode is not affected.\n\nThis issue affects pgAdmin 4: before 9.19."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Scored for the worst variant, which needs no account and no special configuration: unlimited password guesses against an internal account, including the administrator\u0027s, through Flask-Security\u0027s own login view or a username typed in another case. Attack Complexity is High because success still depends on guessing the account\u0027s password. A guessed account gives that account\u0027s access to pgAdmin, so Confidentiality, Integrity and Availability are High (an administrator can create, change and delete users). Scope is Unchanged: the flaw removes the limit on guesses; any impact beyond pgAdmin follows only from a password the attacker has guessed."
}
]
},
{
"cvssV4_0": {
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Same reasoning as the CVSS 3.1 entry. AC:H and AT:P because success depends on guessing a password. VC:H/VI:H/VA:H for the guessed pgAdmin account; no subsequent-system impact is claimed."
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307 Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T19:55:11.056Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/pgadmin-org/pgadmin4/issues/10676"
},
{
"tags": [
"patch"
],
"url": "https://github.com/pgadmin-org/pgadmin4/commit/58c531d831179dc9b0a5bf873ccb80c71c8d387a"
},
{
"tags": [
"patch"
],
"url": "https://github.com/pgadmin-org/pgadmin4/commit/35c9235d17a7d5a99778f01b2f1b9e5e3a3b7fde"
},
{
"tags": [
"patch"
],
"url": "https://github.com/pgadmin-org/pgadmin4/commit/c6ef41a951012cd877a1992b5dac681eec36e48d"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "pgAdmin 4: The failed login limit can be bypassed, and Flask-Security\u0027s own views skip pgAdmin\u0027s login and password checks"
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-116238",
"datePublished": "2026-10-30T19:55:11.056Z",
"dateReserved": "2026-10-25T16:26:16.419Z",
"dateUpdated": "2026-11-06T16:06:41.395Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Common protection mechanisms include:
- Disconnecting the user after a small number of failed attempts
- Implementing a timeout
- Locking out a targeted account
- Requiring a computational task on the user's part.
Mitigation MIT-4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
- Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]
CAPEC-16: Dictionary-based Password Attack
An attacker tries each of the words in a dictionary as passwords to gain access to the system via some user's account. If the password chosen by the user was a word within the dictionary, this attack will be successful (in the absence of other mitigations). This is a specific instance of the password brute forcing attack pattern.
Dictionary Attacks differ from similar attacks such as Password Spraying (CAPEC-565) and Credential Stuffing (CAPEC-600), since they leverage unknown username/password combinations and don't care about inducing account lockouts.
CAPEC-49: Password Brute Forcing
An adversary tries every possible value for a password until they succeed. A brute force attack, if feasible computationally, will always be successful because it will essentially go through all possible passwords given the alphabet used (lower case letters, upper case letters, numbers, symbols, etc.) and the maximum length of the password.
CAPEC-560: Use of Known Domain Credentials
An adversary guesses or obtains (i.e. steals or purchases) legitimate credentials (e.g. userID/password) to achieve authentication and to perform authorized actions under the guise of an authenticated user or service.
CAPEC-565: Password Spraying
In a Password Spraying attack, an adversary tries a small list (e.g. 3-5) of common or expected passwords, often matching the target's complexity policy, against a known list of user accounts to gain valid credentials. The adversary tries a particular password for each user account, before moving onto the next password in the list. This approach assists the adversary in remaining undetected by avoiding rapid or frequent account lockouts. The adversary may then reattempt the process with additional passwords, once enough time has passed to prevent inducing a lockout.
CAPEC-600: Credential Stuffing
An adversary tries known username/password combinations against different systems, applications, or services to gain additional authenticated access. Credential Stuffing attacks rely upon the fact that many users leverage the same username/password combination for multiple systems, applications, and services.
CAPEC-652: Use of Known Kerberos Credentials
An adversary obtains (i.e. steals or purchases) legitimate Kerberos credentials (e.g. Kerberos service account userID/password or Kerberos Tickets) with the goal of achieving authenticated access to additional systems, applications, or services within the domain.
CAPEC-653: Use of Known Operating System Credentials
An adversary guesses or obtains (i.e. steals or purchases) legitimate operating system credentials (e.g. userID/password) to achieve authentication and to perform authorized actions on the system, under the guise of an authenticated user or service. This applies to any Operating System.