CWE-307 Improper Restriction of Excessive Authentication Attempts

Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords

Duplicate Advisory: Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords

Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited

Duplicate Advisory: Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited

Payload: Unauthenticated account-lockout denial of service

Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path

lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks

Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service

9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`

Payload CMS default account-unlock access allows authenticated users to reset other accounts' lockouts

Vikunja Vulnerable to TOTP Brute-Force Due to Non-Functional Account Lockout

NocoDB: User Enumeration via Sign-In Timing

9router: Login brute-force protection bypass via spoofed X-Forwarded-For header

Duplicate Advisory: Wildfly Elytron integration susceptible to brute force attacks via CLI

Authelia Missing Username Canonicalization in Basic Auth (LDAP)

FileBrowser: Missing Rate Limiting on Authentication Endpoint Enables Brute Force Attacks

Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass

Lin-CMS-Flask vulnerable to Improper Authentication

Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation

phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id

Duplicate Advisory: phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id

vantage6 lacks brute-force protection on change password functionality

phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration

Yamcs has No Rate Limiting on Authentication Endpoint