CWE-307 584 CVEs MITRE definition ↗

CWE-307: Improper Restriction of Excessive Authentication Attempts

Overview

CWE-307 (Improper Restriction of Excessive Authentication Attempts) documents a weakness type used across vulnerability databases and security assessments. Use the sections below for definition, context, and mapped CVEs.

Security impact
Security impact: Depends on product and context; use CVE records, severity scores, and MITRE guidance to prioritize.

Description

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Applicable platforms

Kind Name Class Prevalence OS / CPE
language Not Language-Specific Undetermined

Related CVEs in this database

These CVEs are mapped to this weakness in this database and kept for traceability and search.

CVE Published Summary
CVE-2026-43926 2026-06-04 FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the password reset confirmation endpoint `/client/reset-password-confirm/:hash` is handled by a non-API…
CVE-2026-36612 2026-06-03 Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 enables WPS 2.0 by default with a weak lockout policy (60-second lockout after 10 attempts).
CVE-2026-36607 2026-06-03 Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP password change endpoint (code=10), which lacks the rate limiting applied to the…
CVE-2026-10216 2026-06-01 A vulnerability was detected in unitedbyai droidclaw up to 0.5.3. The affected element is an unknown function of the file server/src/routes/pairing.ts of the component claim Endpoint. The manipulation…
CVE-2026-49324 2026-05-29 Uncontrolled resource consumption in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with write access to the in-vehi…
CVE-2026-45364 2026-05-28 Better Auth is an authentication and authorization library for TypeScript. Prior to 1.4.17 and 1.5.0-beta.9, Better Auth's HTTP rate limiter keyed each request by the exact textual IP address it recei…
CVE-2026-35675 2026-05-28 phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user account password without token verification…
CVE-2026-8760 2026-05-27 The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.6. This is due to an incomplete fix for CVE-2024-11178: the rate-limit/lockout ch…
CVE-2026-1816 2026-05-21 Improper restriction of excessive authentication attempts vulnerability in Turkiye Electricity Transmission Corporation (TEİAŞ) Mobile Application allows Brute Force. This issue affects Mobile Applic…
CVE-2020-37228 2026-05-16 iDS6 DSSPro Digital Signage System 6.2 contains a CAPTCHA security bypass vulnerability that allows attackers to bypass authentication by requesting the autoLoginVerifyCode object. Attackers can retri…
CVE-2026-45010 2026-05-15 phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary user-id parameters without session bindi…
CVE-2025-64526 2026-05-14 Strapi is an open source headless content management system. In Strapi versions prior to 5.45.0, the rate-limit middleware in the users-permissions plugin derived its rate-limit key in part from `ctx.…
CVE-2025-62313 2026-05-14 HCL AION is affected by a vulnerability where adequate protections against brute-force attempts are not enforced. This may allow repeated authentication attempts, potentially leading to unauthorized a…
CVE-2026-44195 2026-05-13 OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, a logic flaw in the OPNsense lockout_handler allows an unauthenticated attacker to continuously reset the authentication fai…
CVE-2026-7255 2026-05-12 ** UNSUPPORTED WHEN ASSIGNED ** An improper restriction of excessive authentication attempts vulnerability in the web management interface of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could al…
CVE-2026-43914 2026-05-11 Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows bypassing the login brute-force protection if email 2fa is e…
CVE-2026-7820 2026-05-11 Improper restriction of excessive authentication attempts (CWE-307) in pgAdmin 4. pgAdmin enforces MAX_LOGIN_ATTEMPTS only inside its custom /authenticate/login view. Flask-Security's default /login …
CVE-2026-41893 2026-05-09 Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints (POST /login and POST /signalk/v1/auth/login) are protected by express-r…
CVE-2025-2514 2026-05-07 Improper restriction of excessive authentication attempts vulnerability in Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900, Hitachi Virtual Storage Platform…
CVE-2023-54347 2026-05-05 OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protections by sending repeated login attempts to the main login endpoint. Attackers ca…

Previous names

  • Multiple Failed Authentication Attempts not Prevented (2008-04-11)
  • Failure to Restrict Excessive Authentication Attempts (2010-02-16)

Content submission

Name
PLOVER
Date
2006-07-19
Version
Draft 3

Content modifications

Date Name Version Importance Comment
2008-07-01 Sean Eidemiller 1.0 added/updated demonstrative examples
2008-09-08 CWE Content Team 1.0 updated Relationships, Taxonomy_Mappings
2009-03-10 CWE Content Team 1.3 updated Relationships
2009-07-27 CWE Content Team 1.5 updated Observed_Examples
2009-12-28 CWE Content Team 1.7 updated Applicable_Platforms, Demonstrative_Examples, Potential_Mitigations
2010-02-16 CWE Content Team 1.8 updated Demonstrative_Examples, Name, Potential_Mitigations, Relationships, Taxonomy_Mappings
2010-04-05 CWE Content Team 1.8.1 updated Demonstrative_Examples
2011-03-29 CWE Content Team 1.12 updated Demonstrative_Examples
2011-06-01 CWE Content Team 1.13 updated Common_Consequences
2011-06-27 CWE Content Team 2.0 updated Common_Consequences, Related_Attack_Patterns, Relationships
2011-09-13 CWE Content Team 2.1 updated Potential_Mitigations, References, Relationships
2012-05-11 CWE Content Team 2.2 updated Relationships
2014-07-30 CWE Content Team 2.8 updated Detection_Factors, Relationships, Taxonomy_Mappings
2017-11-08 CWE Content Team 3.0 updated Demonstrative_Examples, Modes_of_Introduction, Relationships
2019-06-20 CWE Content Team 3.3 updated Demonstrative_Examples, Relationships
2020-02-24 CWE Content Team 4.0 updated Detection_Factors, Relationships
2020-08-20 CWE Content Team 4.2 updated Related_Attack_Patterns
2021-10-28 CWE Content Team 4.6 updated Demonstrative_Examples, References, Relationships
2022-10-13 CWE Content Team 4.9 updated Demonstrative_Examples, Description, Observed_Examples, References, Relationships
2023-04-27 CWE Content Team 4.11 updated Demonstrative_Examples, References, Relationships
2023-06-29 CWE Content Team 4.12 updated Mapping_Notes
2024-11-19 CWE Content Team 4.16 updated Common_Consequences, Description, Diagram
2025-09-09 CWE Content Team 4.18 updated Demonstrative_Examples, Detection_Factors, Potential_Mitigations, References
2025-12-11 CWE Content Team 4.19 updated Relationships, Weakness_Ordinalities

Contributions

Type Name Date Comment
Content Abhi Balakrishnan 2024-09-10 Contributed usability diagram concepts used by the CWE team
cvelogic Threat Intelligence