Common Weakness Enumeration
CWE-645 Overly Restrictive Account Lockout Mechanism
Description
The product contains an account lockout protection mechanism, but the mechanism is too restrictive and can be triggered too easily, which allows attackers to deny service to legitimate users by causing their accounts to be locked out.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-645 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-v5gf-vpjc-pc7w | CVE-2026-105866 | MODERATE |
Payload: Unauthenticated account-lockout denial of service |
2026-10-07 | |
| GHSA-qgwx-rffp-6cx9 | CVE-2025-31947 | MODERATE |
Mattermost Fails to Lockout LDAP Users After Repeated Login Failures |
2025-05-17 | |
| GHSA-3hrr-xwvg-hxvr | - | LOW |
Duplicate Advisory: Keycloak DoS via account lockout |
2024-12-20 |