CWE-307 603 個 CVE MITRE 定義 ↗

CWE-307:Improper Restriction of Excessive Authentication Attempts

概覽

CWE-307(Improper Restriction of Excessive Authentication Attempts)描述一種在漏洞資料庫與安全評估中使用的弱點類型;定義、背景與對應 CVE 見下方各節。

安全影響
安全影響:因產品與情境而異;請結合 CVE 紀錄、嚴重度評分與 MITRE 說明進行優先級判斷。

描述

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

適用平台

類型 名稱 普遍性 OS / CPE
language Not Language-Specific Undetermined

本庫相關 CVE

下列 CVE 在本庫中對應到該弱點,並保留以便追溯與檢索。

CVE 公開時間 摘要
CVE-2026-8285 2026-07-21 Improper restriction of excessive authentication attempts vulnerability in Universal Software Inc. FlexCity allows Excessive Allocation. This issue affects FlexCity: from 5.536.0 through 11052026.
CVE-2026-32825 2026-07-20 dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and…
CVE-2026-62220 2026-07-16 OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts. When the affected feature is enabled and…
CVE-2026-44596 2026-07-16 Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any …
CVE-2026-14254 2026-07-16 A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout threshold to be bypassed through concurrent authentication requests. Parallel login attempts were proces…
CVE-2026-61458 2026-07-13 PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a pus…
CVE-2026-42952 2026-07-10 Previously, there was no throttling on repeated authentication attempts to the charging station backend, which could allow an attacker to execute a denial-of-service attack.
CVE-2026-11915 2026-07-10 vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.
CVE-2026-15079 2026-07-10 Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions: from 0.0.0 to 2.1.4.
CVE-2026-55501 2026-07-10 9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/auth/loginLimiter.js derives the client identity from the attacker-controlled X-Forwarded-For HTTP h…
CVE-2026-53904 2026-07-01 MCO is vulnerable to Account Denial of Service due to improper implementation of password reset functionality. Each password reset request invalidates previously set password as well as previously iss…
CVE-2026-35098 2026-06-30 KTM System e-BOK does not implement any limit or timeout on consecutive login attempts, allowing an attacker to perform unlimited authentication requests. This lack of rate‑limiting enables efficient …
CVE-2026-11779 2026-06-26 An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation.
CVE-2026-50176 2026-06-25 The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or…
CVE-2026-47380 2026-06-23 NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, sign-in response timing differed between known and unknown email addresses because the unknown-user branch returned witho…
CVE-2026-56234 2026-06-23 Capgo before 12.128.2 contains a credential validation vulnerability in the POST /functions/v1/private/validate_password_compliance endpoint that is callable using only the public Supabase key without…
CVE-2026-56450 2026-06-22 AIL did not restrict repeated failed attempts to verify a two-factor authentication (OTP) code. An attacker who had reached the 2FA verification step, such as after successfully completing the passwor…
CVE-2026-47203 2026-06-19 Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In versions 4.38.0 through 4.39.19, w…
CVE-2026-6853 2026-06-12 Improper restriction of excessive authentication attempts vulnerability in Başbelen Group Food Cafe Businesses Industry and Trade Ltd. Co. Pause+ Mobile App allows Authentication Bypass. This issue a…
CVE-2026-3329 2026-06-11 A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints.

曾用名

  • Multiple Failed Authentication Attempts not Prevented (2008-04-11)
  • Failure to Restrict Excessive Authentication Attempts (2010-02-16)

內容提交

名稱
PLOVER
日期
2006-07-19
版本
Draft 3

內容修訂

日期 名稱 版本 重要性 評論
2008-07-01 Sean Eidemiller 1.0 added/updated demonstrative examples
2008-09-08 CWE Content Team 1.0 updated Relationships, Taxonomy_Mappings
2009-03-10 CWE Content Team 1.3 updated Relationships
2009-07-27 CWE Content Team 1.5 updated Observed_Examples
2009-12-28 CWE Content Team 1.7 updated Applicable_Platforms, Demonstrative_Examples, Potential_Mitigations
2010-02-16 CWE Content Team 1.8 updated Demonstrative_Examples, Name, Potential_Mitigations, Relationships, Taxonomy_Mappings
2010-04-05 CWE Content Team 1.8.1 updated Demonstrative_Examples
2011-03-29 CWE Content Team 1.12 updated Demonstrative_Examples
2011-06-01 CWE Content Team 1.13 updated Common_Consequences
2011-06-27 CWE Content Team 2.0 updated Common_Consequences, Related_Attack_Patterns, Relationships
2011-09-13 CWE Content Team 2.1 updated Potential_Mitigations, References, Relationships
2012-05-11 CWE Content Team 2.2 updated Relationships
2014-07-30 CWE Content Team 2.8 updated Detection_Factors, Relationships, Taxonomy_Mappings
2017-11-08 CWE Content Team 3.0 updated Demonstrative_Examples, Modes_of_Introduction, Relationships
2019-06-20 CWE Content Team 3.3 updated Demonstrative_Examples, Relationships
2020-02-24 CWE Content Team 4.0 updated Detection_Factors, Relationships
2020-08-20 CWE Content Team 4.2 updated Related_Attack_Patterns
2021-10-28 CWE Content Team 4.6 updated Demonstrative_Examples, References, Relationships
2022-10-13 CWE Content Team 4.9 updated Demonstrative_Examples, Description, Observed_Examples, References, Relationships
2023-04-27 CWE Content Team 4.11 updated Demonstrative_Examples, References, Relationships
2023-06-29 CWE Content Team 4.12 updated Mapping_Notes
2024-11-19 CWE Content Team 4.16 updated Common_Consequences, Description, Diagram
2025-09-09 CWE Content Team 4.18 updated Demonstrative_Examples, Detection_Factors, Potential_Mitigations, References
2025-12-11 CWE Content Team 4.19 updated Relationships, Weakness_Ordinalities

貢獻

類型 名稱 日期 評論
Content Abhi Balakrishnan 2024-09-10 Contributed usability diagram concepts used by the CWE team
cvelogic Threat Intelligence