CWE-307
AllowedImproper Restriction of Excessive Authentication Attempts
Abstraction: Base · Status: Draft
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
900 vulnerabilities reference this CWE, most recent first.
GHSA-X6G3-9CV4-7822
Vulnerability from github – Published: 2022-06-03 00:00 – Updated: 2022-06-14 00:00Dell Unity, Dell UnityVSA, and Dell Unity XT versions before 5.2.0.0.5.173 do not restrict excessive authentication attempts in Unisphere GUI. A remote unauthenticated attacker may potentially exploit this vulnerability to brute-force passwords and gain access to the system as the victim. Account takeover is possible if weak passwords are used by users.
{
"affected": [],
"aliases": [
"CVE-2022-29084"
],
"database_specific": {
"cwe_ids": [
"CWE-307"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-02T21:15:00Z",
"severity": "CRITICAL"
},
"details": "Dell Unity, Dell UnityVSA, and Dell Unity XT versions before 5.2.0.0.5.173 do not restrict excessive authentication attempts in Unisphere GUI. A remote unauthenticated attacker may potentially exploit this vulnerability to brute-force passwords and gain access to the system as the victim. Account takeover is possible if weak passwords are used by users.",
"id": "GHSA-x6g3-9cv4-7822",
"modified": "2022-06-14T00:00:29Z",
"published": "2022-06-03T00:00:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29084"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/000199050"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-X6PP-HP65-C29V
Vulnerability from github – Published: 2024-06-04 00:30 – Updated: 2024-06-04 00:30Improper Restriction of Excessive Authentication Attempts vulnerability in Brainstorm Force Spectra allows Functionality Bypass.This issue affects Spectra: from n/a through 2.3.0.
{
"affected": [],
"aliases": [
"CVE-2023-23730"
],
"database_specific": {
"cwe_ids": [
"CWE-307"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-03T22:15:08Z",
"severity": "MODERATE"
},
"details": "Improper Restriction of Excessive Authentication Attempts vulnerability in Brainstorm Force Spectra allows Functionality Bypass.This issue affects Spectra: from n/a through 2.3.0.",
"id": "GHSA-x6pp-hp65-c29v",
"modified": "2024-06-04T00:30:46Z",
"published": "2024-06-04T00:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23730"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/ultimate-addons-for-gutenberg/wordpress-spectra-wordpress-gutenberg-blocks-plugin-2-3-0-captcha-bypass-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X987-QR32-MR7C
Vulnerability from github – Published: 2025-03-06 18:31 – Updated: 2025-03-06 18:31IBM Concert Software 1.0.5 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.
{
"affected": [],
"aliases": [
"CVE-2024-51476"
],
"database_specific": {
"cwe_ids": [
"CWE-307"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-06T17:15:19Z",
"severity": "HIGH"
},
"details": "IBM Concert Software 1.0.5 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.",
"id": "GHSA-x987-qr32-mr7c",
"modified": "2025-03-06T18:31:10Z",
"published": "2025-03-06T18:31:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51476"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7184961"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XC7F-MPVM-WR8P
Vulnerability from github – Published: 2022-05-24 19:10 – Updated: 2022-05-24 19:10IBM Security Guardium 11.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 196314.
{
"affected": [],
"aliases": [
"CVE-2021-20427"
],
"database_specific": {
"cwe_ids": [
"CWE-307"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-11T16:15:00Z",
"severity": "HIGH"
},
"details": "IBM Security Guardium 11.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 196314.",
"id": "GHSA-xc7f-mpvm-wr8p",
"modified": "2022-05-24T19:10:41Z",
"published": "2022-05-24T19:10:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20427"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/196314"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6479913"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-XCQR-9H24-VRGW
Vulnerability from github – Published: 2021-07-26 21:19 – Updated: 2024-08-07 19:44As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence.
Specific Go Packages Affected
github.com/argoproj/argo-cd/util/cache
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/argoproj/argo-cd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-8827"
],
"database_specific": {
"cwe_ids": [
"CWE-307"
],
"github_reviewed": true,
"github_reviewed_at": "2021-07-26T21:13:31Z",
"nvd_published_at": "2020-04-08T20:15:00Z",
"severity": "HIGH"
},
"details": "As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence.\n\n### Specific Go Packages Affected\ngithub.com/argoproj/argo-cd/util/cache",
"id": "GHSA-xcqr-9h24-vrgw",
"modified": "2024-08-07T19:44:00Z",
"published": "2021-07-26T21:19:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8827"
},
{
"type": "WEB",
"url": "https://github.com/argoproj/argo-cd/pull/3369"
},
{
"type": "WEB",
"url": "https://github.com/argoproj/argo-cd/pull/3404"
},
{
"type": "WEB",
"url": "https://github.com/argoproj/argo-cd/commit/35a7350b7444bcaf53ee0bb11b9d8e3ae4b717a1"
},
{
"type": "WEB",
"url": "https://argoproj.github.io/argo-cd/operator-manual/user-management/#disable-admin-user"
},
{
"type": "WEB",
"url": "https://argoproj.github.io/argo-cd/security_considerations"
},
{
"type": "WEB",
"url": "https://github.com/argoproj/argo/releases"
},
{
"type": "WEB",
"url": "https://www.soluble.ai/blog/argo-cves-2020"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Improper Restriction of Excessive Authentication Attempts in Argo API"
}
GHSA-XCVH-9J7M-6VW3
Vulnerability from github – Published: 2026-04-16 06:31 – Updated: 2026-04-22 21:31Eaton Intelligent Power Protector (IPP) software allows repeated authentication attempts against the web interface login page due to insufficient rate‑limiting controls. This security issue has been fixed in the latest version of Eaton IPP which is available on the Eaton download centre.
{
"affected": [],
"aliases": [
"CVE-2026-22616"
],
"database_specific": {
"cwe_ids": [
"CWE-307"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-16T05:16:14Z",
"severity": "MODERATE"
},
"details": "Eaton\u00a0Intelligent Power Protector (IPP)\u00a0software\u00a0allows repeated authentication attempts against the web interface login page due to insufficient rate\u2011limiting controls.\u00a0This security issue has been fixed in the latest version of Eaton IPP which is available on the Eaton download centre.",
"id": "GHSA-xcvh-9j7m-6vw3",
"modified": "2026-04-22T21:31:47Z",
"published": "2026-04-16T06:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22616"
},
{
"type": "WEB",
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1025.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XFRF-82V4-75GF
Vulnerability from github – Published: 2022-05-24 16:54 – Updated: 2023-01-31 21:30IBM Security Guardium Big Data Intelligence 4.0 (SonarG) uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 161036.
{
"affected": [],
"aliases": [
"CVE-2019-4310"
],
"database_specific": {
"cwe_ids": [
"CWE-307"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-20T19:15:00Z",
"severity": "HIGH"
},
"details": "IBM Security Guardium Big Data Intelligence 4.0 (SonarG) uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 161036.",
"id": "GHSA-xfrf-82v4-75gf",
"modified": "2023-01-31T21:30:18Z",
"published": "2022-05-24T16:54:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-4310"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/161036"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10960298"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XGXP-CC5R-JFJQ
Vulnerability from github – Published: 2022-05-24 19:06 – Updated: 2022-05-24 19:06An issue was discovered in Stormshield SNS through 4.2.1. A brute-force attack can occur.
{
"affected": [],
"aliases": [
"CVE-2021-28127"
],
"database_specific": {
"cwe_ids": [
"CWE-307"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-01T15:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Stormshield SNS through 4.2.1. A brute-force attack can occur.",
"id": "GHSA-xgxp-cc5r-jfjq",
"modified": "2022-05-24T19:06:42Z",
"published": "2022-05-24T19:06:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28127"
},
{
"type": "WEB",
"url": "https://advisories.stormshield.eu"
},
{
"type": "WEB",
"url": "https://advisories.stormshield.eu/2021-006"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-XH3J-M8P6-2HJH
Vulnerability from github – Published: 2025-08-08 18:32 – Updated: 2025-08-08 18:32The affected product does not limit the number of attempts for inputting the correct PIN for a registered product, which may allow an attacker to gain unauthorized access using brute-force methods if they possess a valid device serial number. The API provides clear feedback when the correct PIN is entered. This vulnerability was patched in a server-side update on April 6, 2025.
{
"affected": [],
"aliases": [
"CVE-2025-46414"
],
"database_specific": {
"cwe_ids": [
"CWE-307"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-08T17:15:28Z",
"severity": "CRITICAL"
},
"details": "The affected product does not limit the number of attempts for inputting\n the correct PIN for a registered product, which may allow an attacker \nto gain unauthorized access using brute-force methods if they possess a \nvalid device serial number. The API provides clear feedback when the \ncorrect PIN is entered. This vulnerability was patched in a server-side \nupdate on April 6, 2025.",
"id": "GHSA-xh3j-m8p6-2hjh",
"modified": "2025-08-08T18:32:22Z",
"published": "2025-08-08T18:32:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46414"
},
{
"type": "WEB",
"url": "https://eg4electronics.com/contact"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-07"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-XH8J-8X8H-3F2M
Vulnerability from github – Published: 2022-05-24 17:23 – Updated: 2022-05-24 17:23OpenClinic GA versions 5.09.02 and 5.89.05b contain an authentication mechanism within the system that does not provide sufficient complexity to protect against brute force attacks, which may allow unauthorized users to access the system after no more than a fixed maximum number of attempts.
{
"affected": [],
"aliases": [
"CVE-2020-14494"
],
"database_specific": {
"cwe_ids": [
"CWE-307"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-07-20T15:15:00Z",
"severity": "MODERATE"
},
"details": "OpenClinic GA versions 5.09.02 and 5.89.05b contain an authentication mechanism within the system that does not provide sufficient complexity to protect against brute force attacks, which may allow unauthorized users to access the system after no more than a fixed maximum number of attempts.",
"id": "GHSA-xh8j-8x8h-3f2m",
"modified": "2022-05-24T17:23:58Z",
"published": "2022-05-24T17:23:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14494"
},
{
"type": "WEB",
"url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-184-01"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
- Common protection mechanisms include:
- Disconnecting the user after a small number of failed attempts
- Implementing a timeout
- Locking out a targeted account
- Requiring a computational task on the user's part.
Mitigation MIT-4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
- Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]
CAPEC-16: Dictionary-based Password Attack
An attacker tries each of the words in a dictionary as passwords to gain access to the system via some user's account. If the password chosen by the user was a word within the dictionary, this attack will be successful (in the absence of other mitigations). This is a specific instance of the password brute forcing attack pattern.
Dictionary Attacks differ from similar attacks such as Password Spraying (CAPEC-565) and Credential Stuffing (CAPEC-600), since they leverage unknown username/password combinations and don't care about inducing account lockouts.
CAPEC-49: Password Brute Forcing
An adversary tries every possible value for a password until they succeed. A brute force attack, if feasible computationally, will always be successful because it will essentially go through all possible passwords given the alphabet used (lower case letters, upper case letters, numbers, symbols, etc.) and the maximum length of the password.
CAPEC-560: Use of Known Domain Credentials
An adversary guesses or obtains (i.e. steals or purchases) legitimate credentials (e.g. userID/password) to achieve authentication and to perform authorized actions under the guise of an authenticated user or service.
CAPEC-565: Password Spraying
In a Password Spraying attack, an adversary tries a small list (e.g. 3-5) of common or expected passwords, often matching the target's complexity policy, against a known list of user accounts to gain valid credentials. The adversary tries a particular password for each user account, before moving onto the next password in the list. This approach assists the adversary in remaining undetected by avoiding rapid or frequent account lockouts. The adversary may then reattempt the process with additional passwords, once enough time has passed to prevent inducing a lockout.
CAPEC-600: Credential Stuffing
An adversary tries known username/password combinations against different systems, applications, or services to gain additional authenticated access. Credential Stuffing attacks rely upon the fact that many users leverage the same username/password combination for multiple systems, applications, and services.
CAPEC-652: Use of Known Kerberos Credentials
An adversary obtains (i.e. steals or purchases) legitimate Kerberos credentials (e.g. Kerberos service account userID/password or Kerberos Tickets) with the goal of achieving authenticated access to additional systems, applications, or services within the domain.
CAPEC-653: Use of Known Operating System Credentials
An adversary guesses or obtains (i.e. steals or purchases) legitimate operating system credentials (e.g. userID/password) to achieve authentication and to perform authorized actions on the system, under the guise of an authenticated user or service. This applies to any Operating System.