Common Weakness Enumeration
CWE-307
AllowedImproper Restriction of Excessive Authentication Attempts
Abstraction: Base · Status: Draft
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
1037 vulnerabilities reference this CWE, most recent first.
CVE-2026-105866 (GCVE-0-2026-105866)
Vulnerability from cvelistv5 – Published: 2026-10-06 16:46 – Updated: 2026-10-06 17:39
VLAI
EPSS
VEX
Title
Payload: Unauthenticated account-lockout denial of service
Summary
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account lockout mechanism of a local-authentication collection to prevent that account from signing in. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 17:34 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/payloadcms/payload/security/ad… | x_refsource_CONFIRM |
| https://github.com/payloadcms/payload/commit/1c46… | x_refsource_MISC |
| https://github.com/payloadcms/payload/releases/ta… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| payloadcms | payload |
Affected:
< 3.90.0
Affected: >= 4.0.0-canary.0, < 4.0.0-canary.34 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105866",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T17:34:37.543263Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:39:09.686Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "payload",
"vendor": "payloadcms",
"versions": [
{
"status": "affected",
"version": "\u003c 3.90.0"
},
{
"status": "affected",
"version": "\u003e= 4.0.0-canary.0, \u003c 4.0.0-canary.34"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account lockout mechanism of a local-authentication collection to prevent that account from signing in. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307: Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-645",
"description": "CWE-645: Overly Restrictive Account Lockout Mechanism",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T16:46:31.069Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/payloadcms/payload/security/advisories/GHSA-v5gf-vpjc-pc7w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/payloadcms/payload/security/advisories/GHSA-v5gf-vpjc-pc7w"
},
{
"name": "https://github.com/payloadcms/payload/commit/1c46204a73a0a9f988a80c52690eee5a4ada3cf1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/payloadcms/payload/commit/1c46204a73a0a9f988a80c52690eee5a4ada3cf1"
},
{
"name": "https://github.com/payloadcms/payload/releases/tag/v3.90.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/payloadcms/payload/releases/tag/v3.90.0"
}
],
"source": {
"advisory": "GHSA-v5gf-vpjc-pc7w",
"discovery": "UNKNOWN"
},
"title": "Payload: Unauthenticated account-lockout denial of service"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105866",
"datePublished": "2026-10-06T16:46:31.069Z",
"dateReserved": "2026-10-05T23:06:29.748Z",
"dateUpdated": "2026-10-06T17:39:09.686Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105835 (GCVE-0-2026-105835)
Vulnerability from cvelistv5 – Published: 2026-10-06 12:57 – Updated: 2026-10-06 12:57
VLAI
EPSS
VEX
Title
PLANKA 2.2.0 through 2.2.1 TOTP Brute Force via verify-totp Endpoint
Summary
PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one succeeds, obtaining a full access token.
Severity
7.4 (High)
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/plankanban/planka/commit/de4d7… | patch |
| https://github.com/plankanban/planka/blob/v2.2.1/… | technical-description |
| https://github.com/plankanban/planka | product |
| https://www.vulncheck.com/advisories/planka-2.2.0… | third-party-advisory |
Impacted products
Date Public
2026-08-28 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/plankanban/planka",
"product": "planka",
"repo": "https://github.com/plankanban/planka",
"vendor": "planka",
"versions": [
{
"lessThanOrEqual": "2.2.1",
"status": "affected",
"version": "2.2.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:planka:planka:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.2.1",
"versionStartIncluding": "2.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eldor Nabijonov"
}
],
"datePublic": "2026-08-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user\u0027s password can reuse the ten-minute pending token to guess six-digit codes until one succeeds, obtaining a full access token."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T12:57:55.187Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/plankanban/planka/commit/de4d7688317829e2a0b665fe9dbf39eaf127b6f9"
},
{
"name": "verify-totp controller at v2.2.1",
"tags": [
"technical-description"
],
"url": "https://github.com/plankanban/planka/blob/v2.2.1/server/api/controllers/access-tokens/verify-totp.js"
},
{
"tags": [
"product"
],
"url": "https://github.com/plankanban/planka"
},
{
"name": "VulnCheck Advisory: PLANKA 2.2.0 through 2.2.1 TOTP Brute Force via verify-totp Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/planka-2.2.0-through-2.2.1-totp-brute-force-via-verify-totp-endpoint"
}
],
"title": "PLANKA 2.2.0 through 2.2.1 TOTP Brute Force via verify-totp Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-105835",
"datePublished": "2026-10-06T12:57:55.187Z",
"dateReserved": "2026-10-05T22:00:10.841Z",
"dateUpdated": "2026-10-06T12:57:55.187Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105638 (GCVE-0-2026-105638)
Vulnerability from cvelistv5 – Published: 2026-10-05 18:09 – Updated: 2026-10-05 18:44
VLAI
EPSS
VEX
Title
Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force
Summary
Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and an incorrect code does not increment a counter, invalidate the Redis entry, or lock the email address. The verifier extends django.views.View rather than DRF's APIView, so the configured AnonRateThrottle limit does not apply. The middleware stack also contains no Django-level rate limiter such as django-ratelimit, django-axes, or an IP-throttling middleware. This vulnerability is fixed in 1.4.0.
Severity
9.1 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 18:43 UTC
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/makeplane/plane/security/advis… | x_refsource_CONFIRM |
| https://github.com/makeplane/plane/pull/9130 | x_refsource_MISC |
| https://github.com/makeplane/plane/commit/b1c78fe… | x_refsource_MISC |
| https://github.com/makeplane/plane/releases/tag/v1.4.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105638",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-05T18:43:46.990678Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T18:44:08.562Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/makeplane/plane/security/advisories/GHSA-mqjv-rwgv-4gxq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "plane",
"vendor": "makeplane",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Plane is an open-source project management tool. Prior to 1.4.0, Plane\u0027s magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and an incorrect code does not increment a counter, invalidate the Redis entry, or lock the email address. The verifier extends django.views.View rather than DRF\u0027s APIView, so the configured AnonRateThrottle limit does not apply. The middleware stack also contains no Django-level rate limiter such as django-ratelimit, django-axes, or an IP-throttling middleware. This vulnerability is fixed in 1.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307: Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T18:09:35.649Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/makeplane/plane/security/advisories/GHSA-mqjv-rwgv-4gxq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/makeplane/plane/security/advisories/GHSA-mqjv-rwgv-4gxq"
},
{
"name": "https://github.com/makeplane/plane/pull/9130",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/makeplane/plane/pull/9130"
},
{
"name": "https://github.com/makeplane/plane/commit/b1c78fe4c832e188454840eb38fd20cd05ef8b0a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/makeplane/plane/commit/b1c78fe4c832e188454840eb38fd20cd05ef8b0a"
},
{
"name": "https://github.com/makeplane/plane/releases/tag/v1.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/makeplane/plane/releases/tag/v1.4.0"
}
],
"source": {
"advisory": "GHSA-mqjv-rwgv-4gxq",
"discovery": "UNKNOWN"
},
"title": "Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105638",
"datePublished": "2026-10-05T18:09:35.649Z",
"dateReserved": "2026-10-05T16:40:39.611Z",
"dateUpdated": "2026-10-05T18:44:08.562Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105237 (GCVE-0-2026-105237)
Vulnerability from cvelistv5 – Published: 2026-10-05 06:00 – Updated: 2026-10-05 15:30
VLAI
EPSS
VEX
Title
linlinjava litemall Login Endpoint AdminAuthController.java excessive authentication
Summary
A vulnerability was detected in linlinjava litemall up to 1.8.0. This affects an unknown part of the file litemall-admin-api/src/main/java/org/linlinjava/litemall/admin/web/AdminAuthController.java of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 15:10 UTC
CWE
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/413449 | vdb-entry |
| https://vuldb.com/vuln/413449/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-105237 | third-party-advisory |
| https://vuldb.com/submit/975124 | third-party-advisory |
| https://github.com/linlinjava/litemall/issues/584 | exploitissue-tracking |
| https://github.com/linlinjava/litemall/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| linlinjava | litemall |
Affected:
1.0
Affected: 1.1 Affected: 1.2 Affected: 1.3 Affected: 1.4 Affected: 1.5 Affected: 1.6 Affected: 1.7 Affected: 1.8.0 cpe:2.3:a:linlinjava:litemall:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105237",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-05T15:10:42.531519Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T15:30:05.623Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:linlinjava:litemall:*:*:*:*:*:*:*:*"
],
"modules": [
"Login Endpoint"
],
"product": "litemall",
"vendor": "linlinjava",
"versions": [
{
"status": "affected",
"version": "1.0"
},
{
"status": "affected",
"version": "1.1"
},
{
"status": "affected",
"version": "1.2"
},
{
"status": "affected",
"version": "1.3"
},
{
"status": "affected",
"version": "1.4"
},
{
"status": "affected",
"version": "1.5"
},
{
"status": "affected",
"version": "1.6"
},
{
"status": "affected",
"version": "1.7"
},
{
"status": "affected",
"version": "1.8.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "s1mple_xy (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in linlinjava litemall up to 1.8.0. This affects an unknown part of the file litemall-admin-api/src/main/java/org/linlinjava/litemall/admin/web/AdminAuthController.java of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-799",
"description": "Improper Control of Interaction Frequency",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T06:00:11.321Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-413449 | linlinjava litemall Login Endpoint AdminAuthController.java excessive authentication",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/413449"
},
{
"name": "VDB-413449 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/413449/cti"
},
{
"name": "CVE-2026-105237 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-105237"
},
{
"name": "Submit #975124 | linlinjava litemall v1.8.0 CWE-307",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/975124"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/linlinjava/litemall/issues/584"
},
{
"tags": [
"product"
],
"url": "https://github.com/linlinjava/litemall/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-04T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-04T18:15:39.000Z",
"value": "VulDB entry last update"
}
],
"title": "linlinjava litemall Login Endpoint AdminAuthController.java excessive authentication",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-105237",
"datePublished": "2026-10-05T06:00:11.321Z",
"dateReserved": "2026-10-04T16:10:34.297Z",
"dateUpdated": "2026-10-05T15:30:05.623Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102825 (GCVE-0-2026-102825)
Vulnerability from cvelistv5 – Published: 2026-09-29 18:31 – Updated: 2026-09-30 19:29
VLAI
EPSS
VEX
Title
Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path
Summary
Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs increments self.common.auth_attempts but never compares it with server::Config.max_auth_attempts. An unauthenticated remote client can continue submitting authentication requests on one connection beyond the configured cap, bypassing the deployment's attempt-limiting policy and increasing online guessing opportunity and backend authentication workload. This issue is fixed in version 0.62.6.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 19:29 UTC
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/Eugeny/russh/security/advisori… | x_refsource_CONFIRM |
| https://github.com/Eugeny/russh/commit/f8fd0b11a3… | x_refsource_MISC |
| https://github.com/Eugeny/russh/releases/tag/v0.62.6 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102825",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T19:29:11.461462Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T19:29:26.432Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Eugeny/russh/security/advisories/GHSA-g6xm-f9xp-qq35"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "russh",
"vendor": "Eugeny",
"versions": [
{
"status": "affected",
"version": "\u003c 0.62.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs increments self.common.auth_attempts but never compares it with server::Config.max_auth_attempts. An unauthenticated remote client can continue submitting authentication requests on one connection beyond the configured cap, bypassing the deployment\u0027s attempt-limiting policy and increasing online guessing opportunity and backend authentication workload. This issue is fixed in version 0.62.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307: Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T18:31:32.393Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Eugeny/russh/security/advisories/GHSA-g6xm-f9xp-qq35",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Eugeny/russh/security/advisories/GHSA-g6xm-f9xp-qq35"
},
{
"name": "https://github.com/Eugeny/russh/commit/f8fd0b11a393364dc7f01a182482d86adafdd653",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Eugeny/russh/commit/f8fd0b11a393364dc7f01a182482d86adafdd653"
},
{
"name": "https://github.com/Eugeny/russh/releases/tag/v0.62.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Eugeny/russh/releases/tag/v0.62.6"
}
],
"source": {
"advisory": "GHSA-g6xm-f9xp-qq35",
"discovery": "UNKNOWN"
},
"title": "Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102825",
"datePublished": "2026-09-29T18:31:32.393Z",
"dateReserved": "2026-09-29T17:25:25.265Z",
"dateUpdated": "2026-09-30T19:29:26.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102334 (GCVE-0-2026-102334)
Vulnerability from cvelistv5 – Published: 2026-09-28 22:21 – Updated: 2026-09-29 19:47
VLAI
EPSS
VEX
Title
Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection
Summary
Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2fa to gain full session access and administrative control.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 19:47 UTC
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/NginxProxyManager/nginx-proxy-… | patchissue-tracking |
| https://github.com/NginxProxyManager/nginx-proxy-… | technical-description |
| https://github.com/NginxProxyManager/nginx-proxy-… | technical-description |
| https://github.com/NginxProxyManager/nginx-proxy-… | technical-description |
| https://github.com/NginxProxyManager/nginx-proxy-… | product |
| https://www.vulncheck.com/advisories/nginx-proxy-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NginxProxyManager | nginx-proxy-manager |
Affected:
0 , ≤ 2.16.0
(custom)
cpe:2.3:a:nginxproxymanager:nginx_proxy_manager:*:*:*:*:*:*:*:* |
Date Public
2026-09-28 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102334",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T19:47:02.219168Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T19:47:25.772Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/NginxProxyManager/nginx-proxy-manager",
"product": "nginx-proxy-manager",
"repo": "https://github.com/NginxProxyManager/nginx-proxy-manager",
"vendor": "NginxProxyManager",
"versions": [
{
"lessThanOrEqual": "2.16.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nginxproxymanager:nginx_proxy_manager:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.16.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lazizbek Djurayev (Haad TC)"
}
],
"datePublic": "2026-09-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2fa to gain full session access and administrative control."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T22:21:41.072Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/NginxProxyManager/nginx-proxy-manager/pull/5908"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/app.js#L15-L58"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/internal/token.js#L154-L182"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/internal/2fa.js#L196-L240"
},
{
"tags": [
"product"
],
"url": "https://github.com/NginxProxyManager/nginx-proxy-manager"
},
{
"name": "VulnCheck Advisory: Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nginx-proxy-manager-through-2.16.0-missing-brute-force-protection"
}
],
"title": "Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-102334",
"datePublished": "2026-09-28T22:21:41.072Z",
"dateReserved": "2026-09-28T22:08:55.547Z",
"dateUpdated": "2026-09-29T19:47:25.772Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100678 (GCVE-0-2026-100678)
Vulnerability from cvelistv5 – Published: 2026-09-26 13:23 – Updated: 2026-09-30 15:00
VLAI
EPSS
VEX
Title
stoatchat before 0.15.5 MFA Brute Force via Insufficient Rate Limiting
Summary
stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed attempts and distribute guesses across IP addresses to bypass rate limiting and gain account access.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 14:59 UTC
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/stoatchat/stoatchat/security/a… | vendor-advisory |
| https://www.vulncheck.com/advisories/stoatchat-be… | third-party-advisory |
Impacted products
Date Public
2026-09-11 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-100678",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T14:59:59.255314Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T15:00:30.440Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/stoatchat/stoatchat/security/advisories/GHSA-6877-g673-f5r8"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "stoatchat",
"vendor": "stoatchat",
"versions": [
{
"lessThan": "0.15.5",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.15.5",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "QuentinRa"
}
],
"datePublic": "2026-09-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed attempts and distribute guesses across IP addresses to bypass rate limiting and gain account access."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-26T13:23:40.935Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-6877-g673-f5r8)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/stoatchat/stoatchat/security/advisories/GHSA-6877-g673-f5r8"
},
{
"name": "VulnCheck Advisory: stoatchat before 0.15.5 MFA Brute Force via Insufficient Rate Limiting",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-mfa-brute-force-via-insufficient-rate-limiting"
}
],
"title": "stoatchat before 0.15.5 MFA Brute Force via Insufficient Rate Limiting",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-100678",
"datePublished": "2026-09-26T13:23:40.935Z",
"dateReserved": "2026-09-26T02:36:51.809Z",
"dateUpdated": "2026-09-30T15:00:30.440Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100501 (GCVE-0-2026-100501)
Vulnerability from cvelistv5 – Published: 2026-09-25 22:04 – Updated: 2026-10-05 14:55
VLAI
EPSS
VEX
Title
Flame through 2.4.0 Brute-Force Attack via Login Endpoint
Summary
Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password. Attackers can submit unlimited password guesses without rate limiting, attempt counters, lockouts, or delays to gain full administrator access and modify application configuration.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 14:04 UTC
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/pawelmalak/flame/issues/494 | issue-tracking |
| https://github.com/pawelmalak/flame/blob/v2.4.0/r… | technical-description |
| https://github.com/pawelmalak/flame/blob/v2.4.0/c… | technical-description |
| https://github.com/pawelmalak/flame/blob/v2.4.0/.… | technical-description |
| https://github.com/pawelmalak/flame | product |
| https://www.vulncheck.com/advisories/flame-throug… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pawelmalak | flame |
Affected:
0 , ≤ 2.4.0
(custom)
|
Date Public
2026-08-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-100501",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-05T14:04:34.369718Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T14:55:05.164Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "flame",
"vendor": "pawelmalak",
"versions": [
{
"lessThanOrEqual": "2.4.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Whispergate Security Research"
}
],
"datePublic": "2026-08-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password. Attackers can submit unlimited password guesses without rate limiting, attempt counters, lockouts, or delays to gain full administrator access and modify application configuration."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T22:04:01.425Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #494 (finding 1)",
"tags": [
"issue-tracking"
],
"url": "https://github.com/pawelmalak/flame/issues/494"
},
{
"name": "POST /api/auth registered with no rate limiting",
"tags": [
"technical-description"
],
"url": "https://github.com/pawelmalak/flame/blob/v2.4.0/routes/auth.js#L7"
},
{
"name": "login compares the single admin password and issues a JWT",
"tags": [
"technical-description"
],
"url": "https://github.com/pawelmalak/flame/blob/v2.4.0/controllers/auth/login.js#L11-L22"
},
{
"name": "Docker image default PASSWORD",
"tags": [
"technical-description"
],
"url": "https://github.com/pawelmalak/flame/blob/v2.4.0/.docker/Dockerfile#L28"
},
{
"tags": [
"product"
],
"url": "https://github.com/pawelmalak/flame"
},
{
"name": "VulnCheck Advisory: Flame through 2.4.0 Brute-Force Attack via Login Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/flame-through-2.4.0-brute-force-attack-via-login-endpoint"
}
],
"title": "Flame through 2.4.0 Brute-Force Attack via Login Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-100501",
"datePublished": "2026-09-25T22:04:01.425Z",
"dateReserved": "2026-09-25T21:39:02.327Z",
"dateUpdated": "2026-10-05T14:55:05.164Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97363 (GCVE-0-2026-97363)
Vulnerability from cvelistv5 – Published: 2026-10-02 21:32 – Updated: 2026-10-03 15:52
VLAI
EPSS
VEX
Title
Monta monta.app Improper Restriction of Excessive Authentication Attempts
Summary
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-03 15:50 UTC
CWE
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-97363",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-03T15:50:31.877431Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T15:52:54.687Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "monta.app",
"vendor": "Monta",
"versions": [
{
"status": "affected",
"version": "All versions"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access."
}
],
"value": "The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T21:32:30.615Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-02"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-02.json"
}
],
"source": {
"advisory": "ICSA-26-274-02",
"discovery": "UNKNOWN"
},
"title": "Monta monta.app Improper Restriction of Excessive Authentication Attempts",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Monta states that they are actively working to increase adoption of authenticated connections across their network and to deprecate unauthenticated access on a rolling basis. Monta states that they provide support for OCPP 1.6 Security Profile 2 (HTTP Basic Auth with TLS) and encourage operators to enable it."
}
],
"value": "Monta states that they are actively working to increase adoption of authenticated connections across their network and to deprecate unauthenticated access on a rolling basis. Monta states that they provide support for OCPP 1.6 Security Profile 2 (HTTP Basic Auth with TLS) and encourage operators to enable it."
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Monta states that they have implemented rate limiting and automated connection throttling at the WebSocket layer. Connections exhibiting abusive patterns, including rapid reconnection, ID brute-forcing behavior, or excessive command volume, are automatically identified and blocked."
}
],
"value": "Monta states that they have implemented rate limiting and automated connection throttling at the WebSocket layer. Connections exhibiting abusive patterns, including rapid reconnection, ID brute-forcing behavior, or excessive command volume, are automatically identified and blocked."
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Monta states that their platform handles duplicate connection attempts per the OCPP specification, where a new authenticated connection supersedes an existing session for the same station ID."
}
],
"value": "Monta states that their platform handles duplicate connection attempts per the OCPP specification, where a new authenticated connection supersedes an existing session for the same station ID."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-97363",
"datePublished": "2026-10-02T21:32:30.615Z",
"dateReserved": "2026-09-24T16:22:04.109Z",
"dateUpdated": "2026-10-03T15:52:54.687Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93650 (GCVE-0-2026-93650)
Vulnerability from cvelistv5 – Published: 2026-09-18 18:15 – Updated: 2026-09-18 19:47
VLAI
EPSS
VEX
Title
Saleor throttling.py get_client_ip excessive authentication
Summary
A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function get_client_ip of the file saleor/account/throttling.py. Executing a manipulation can lead to improper restriction of excessive authentication attempts. The attack can be executed remotely. The attack requires a high level of complexity. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The projects own issue #19203 internal ticket admits "IP can be spoofed in most deployments" and that its REAL_IP_ENVIRON-type setting bypasses get_client_ip; fix (right-to-left RFC 7239 hop selection) proposed but still unmerged. The vendor explains within an email, that "[t]his is not a vulnerability, this is working at intended, Saleor expects XFF to be configured properly".
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 19:47 UTC
CWE
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/407477 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/407477/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-93650 | third-party-advisory |
| https://vuldb.com/submit/933655 | third-party-advisory |
| https://github.com/zast-ai/vulnerability-reports/… | exploit |
| https://github.com/saleor/saleor/issues/19203 | issue-tracking |
| https://github.com/saleor/saleor/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | Saleor |
Affected:
3.20.118
Affected: 3.21.0 Affected: 3.21.1 Affected: 3.21.2 Affected: 3.21.3 Affected: 3.21.4 Affected: 3.21.5 Affected: 3.21.6 Affected: 3.21.7 Affected: 3.21.8 Affected: 3.21.9 Affected: 3.21.10 Affected: 3.21.11 Affected: 3.21.12 Affected: 3.21.13 Affected: 3.21.14 Affected: 3.21.15 Affected: 3.21.16 Affected: 3.21.17 Affected: 3.21.18 Affected: 3.21.19 Affected: 3.21.20 Affected: 3.21.21 Affected: 3.21.22 Affected: 3.21.23 Affected: 3.21.24 Affected: 3.21.25 Affected: 3.21.26 Affected: 3.21.27 Affected: 3.21.28 Affected: 3.21.29 Affected: 3.21.30 Affected: 3.21.31 Affected: 3.21.32 Affected: 3.21.33 Affected: 3.21.34 Affected: 3.21.35 Affected: 3.21.36 Affected: 3.21.37 Affected: 3.21.38 Affected: 3.21.39 Affected: 3.21.40 Affected: 3.21.41 Affected: 3.21.42 Affected: 3.21.43 Affected: 3.21.44 Affected: 3.21.45 Affected: 3.21.46 Affected: 3.21.47 Affected: 3.21.48 Affected: 3.21.49 Affected: 3.21.50 Affected: 3.21.51 Affected: 3.21.52 Affected: 3.21.53 Affected: 3.21.54 Affected: 3.22.0 Affected: 3.22.1 Affected: 3.22.2 Affected: 3.22.3 Affected: 3.22.4 Affected: 3.22.5 Affected: 3.22.6 Affected: 3.22.7 Affected: 3.22.8 Affected: 3.22.9 Affected: 3.22.10 Affected: 3.22.11 Affected: 3.22.12 Affected: 3.22.13 Affected: 3.22.14 Affected: 3.22.15 Affected: 3.22.16 Affected: 3.22.17 Affected: 3.22.18 Affected: 3.22.19 Affected: 3.22.20 Affected: 3.22.21 Affected: 3.22.22 Affected: 3.22.23 Affected: 3.22.24 Affected: 3.22.25 Affected: 3.22.26 Affected: 3.22.27 Affected: 3.22.28 Affected: 3.22.29 Affected: 3.22.30 Affected: 3.22.31 Affected: 3.22.32 Affected: 3.22.33 Affected: 3.22.34 Affected: 3.22.35 Affected: 3.22.36 Affected: 3.22.37 Affected: 3.22.38 Affected: 3.22.39 Affected: 3.22.40 Affected: 3.22.41 Affected: 3.22.42 Affected: 3.22.43 Affected: 3.22.44 Affected: 3.22.45 Affected: 3.22.46 Affected: 3.22.47 Affected: 3.23.0 Affected: 3.23.1 Affected: 3.23.2 Affected: 3.23.3 Affected: 3.23.4 Affected: 3.23.5 Affected: 3.23.6 Affected: 3.23.7 Affected: 3.23.8 Affected: 3.23.9 Affected: 3.23.10 Affected: 3.23.11 Affected: 3.23.12 Affected: 3.23.13 Affected: 3.23.14 cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93650",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T19:47:42.986649Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:47:52.282Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*"
],
"product": "Saleor",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "3.20.118"
},
{
"status": "affected",
"version": "3.21.0"
},
{
"status": "affected",
"version": "3.21.1"
},
{
"status": "affected",
"version": "3.21.2"
},
{
"status": "affected",
"version": "3.21.3"
},
{
"status": "affected",
"version": "3.21.4"
},
{
"status": "affected",
"version": "3.21.5"
},
{
"status": "affected",
"version": "3.21.6"
},
{
"status": "affected",
"version": "3.21.7"
},
{
"status": "affected",
"version": "3.21.8"
},
{
"status": "affected",
"version": "3.21.9"
},
{
"status": "affected",
"version": "3.21.10"
},
{
"status": "affected",
"version": "3.21.11"
},
{
"status": "affected",
"version": "3.21.12"
},
{
"status": "affected",
"version": "3.21.13"
},
{
"status": "affected",
"version": "3.21.14"
},
{
"status": "affected",
"version": "3.21.15"
},
{
"status": "affected",
"version": "3.21.16"
},
{
"status": "affected",
"version": "3.21.17"
},
{
"status": "affected",
"version": "3.21.18"
},
{
"status": "affected",
"version": "3.21.19"
},
{
"status": "affected",
"version": "3.21.20"
},
{
"status": "affected",
"version": "3.21.21"
},
{
"status": "affected",
"version": "3.21.22"
},
{
"status": "affected",
"version": "3.21.23"
},
{
"status": "affected",
"version": "3.21.24"
},
{
"status": "affected",
"version": "3.21.25"
},
{
"status": "affected",
"version": "3.21.26"
},
{
"status": "affected",
"version": "3.21.27"
},
{
"status": "affected",
"version": "3.21.28"
},
{
"status": "affected",
"version": "3.21.29"
},
{
"status": "affected",
"version": "3.21.30"
},
{
"status": "affected",
"version": "3.21.31"
},
{
"status": "affected",
"version": "3.21.32"
},
{
"status": "affected",
"version": "3.21.33"
},
{
"status": "affected",
"version": "3.21.34"
},
{
"status": "affected",
"version": "3.21.35"
},
{
"status": "affected",
"version": "3.21.36"
},
{
"status": "affected",
"version": "3.21.37"
},
{
"status": "affected",
"version": "3.21.38"
},
{
"status": "affected",
"version": "3.21.39"
},
{
"status": "affected",
"version": "3.21.40"
},
{
"status": "affected",
"version": "3.21.41"
},
{
"status": "affected",
"version": "3.21.42"
},
{
"status": "affected",
"version": "3.21.43"
},
{
"status": "affected",
"version": "3.21.44"
},
{
"status": "affected",
"version": "3.21.45"
},
{
"status": "affected",
"version": "3.21.46"
},
{
"status": "affected",
"version": "3.21.47"
},
{
"status": "affected",
"version": "3.21.48"
},
{
"status": "affected",
"version": "3.21.49"
},
{
"status": "affected",
"version": "3.21.50"
},
{
"status": "affected",
"version": "3.21.51"
},
{
"status": "affected",
"version": "3.21.52"
},
{
"status": "affected",
"version": "3.21.53"
},
{
"status": "affected",
"version": "3.21.54"
},
{
"status": "affected",
"version": "3.22.0"
},
{
"status": "affected",
"version": "3.22.1"
},
{
"status": "affected",
"version": "3.22.2"
},
{
"status": "affected",
"version": "3.22.3"
},
{
"status": "affected",
"version": "3.22.4"
},
{
"status": "affected",
"version": "3.22.5"
},
{
"status": "affected",
"version": "3.22.6"
},
{
"status": "affected",
"version": "3.22.7"
},
{
"status": "affected",
"version": "3.22.8"
},
{
"status": "affected",
"version": "3.22.9"
},
{
"status": "affected",
"version": "3.22.10"
},
{
"status": "affected",
"version": "3.22.11"
},
{
"status": "affected",
"version": "3.22.12"
},
{
"status": "affected",
"version": "3.22.13"
},
{
"status": "affected",
"version": "3.22.14"
},
{
"status": "affected",
"version": "3.22.15"
},
{
"status": "affected",
"version": "3.22.16"
},
{
"status": "affected",
"version": "3.22.17"
},
{
"status": "affected",
"version": "3.22.18"
},
{
"status": "affected",
"version": "3.22.19"
},
{
"status": "affected",
"version": "3.22.20"
},
{
"status": "affected",
"version": "3.22.21"
},
{
"status": "affected",
"version": "3.22.22"
},
{
"status": "affected",
"version": "3.22.23"
},
{
"status": "affected",
"version": "3.22.24"
},
{
"status": "affected",
"version": "3.22.25"
},
{
"status": "affected",
"version": "3.22.26"
},
{
"status": "affected",
"version": "3.22.27"
},
{
"status": "affected",
"version": "3.22.28"
},
{
"status": "affected",
"version": "3.22.29"
},
{
"status": "affected",
"version": "3.22.30"
},
{
"status": "affected",
"version": "3.22.31"
},
{
"status": "affected",
"version": "3.22.32"
},
{
"status": "affected",
"version": "3.22.33"
},
{
"status": "affected",
"version": "3.22.34"
},
{
"status": "affected",
"version": "3.22.35"
},
{
"status": "affected",
"version": "3.22.36"
},
{
"status": "affected",
"version": "3.22.37"
},
{
"status": "affected",
"version": "3.22.38"
},
{
"status": "affected",
"version": "3.22.39"
},
{
"status": "affected",
"version": "3.22.40"
},
{
"status": "affected",
"version": "3.22.41"
},
{
"status": "affected",
"version": "3.22.42"
},
{
"status": "affected",
"version": "3.22.43"
},
{
"status": "affected",
"version": "3.22.44"
},
{
"status": "affected",
"version": "3.22.45"
},
{
"status": "affected",
"version": "3.22.46"
},
{
"status": "affected",
"version": "3.22.47"
},
{
"status": "affected",
"version": "3.23.0"
},
{
"status": "affected",
"version": "3.23.1"
},
{
"status": "affected",
"version": "3.23.2"
},
{
"status": "affected",
"version": "3.23.3"
},
{
"status": "affected",
"version": "3.23.4"
},
{
"status": "affected",
"version": "3.23.5"
},
{
"status": "affected",
"version": "3.23.6"
},
{
"status": "affected",
"version": "3.23.7"
},
{
"status": "affected",
"version": "3.23.8"
},
{
"status": "affected",
"version": "3.23.9"
},
{
"status": "affected",
"version": "3.23.10"
},
{
"status": "affected",
"version": "3.23.11"
},
{
"status": "affected",
"version": "3.23.12"
},
{
"status": "affected",
"version": "3.23.13"
},
{
"status": "affected",
"version": "3.23.14"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ZAST.AI (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function get_client_ip of the file saleor/account/throttling.py. Executing a manipulation can lead to improper restriction of excessive authentication attempts. The attack can be executed remotely. The attack requires a high level of complexity. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The projects own issue #19203 internal ticket admits \"IP can be spoofed in most deployments\" and that its REAL_IP_ENVIRON-type setting bypasses get_client_ip; fix (right-to-left RFC 7239 hop selection) proposed but still unmerged. The vendor explains within an email, that \"[t]his is not a vulnerability, this is working at intended, Saleor expects XFF to be configured properly\"."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-799",
"description": "Improper Control of Interaction Frequency",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T18:15:10.080Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-407477 | Saleor throttling.py get_client_ip excessive authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/407477"
},
{
"name": "VDB-407477 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/407477/cti"
},
{
"name": "CVE-2026-93650 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-93650"
},
{
"name": "Submit #933655 | saleor \u003c=3.23.14 Improper Restriction of Excessive Authentication Attempts",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/933655"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/zast-ai/vulnerability-reports/blob/main/saleor/bruteforce.md"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/saleor/saleor/issues/19203"
},
{
"tags": [
"product"
],
"url": "https://github.com/saleor/saleor/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-18T15:13:21.000Z",
"value": "VulDB entry last update"
}
],
"title": "Saleor throttling.py get_client_ip excessive authentication",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-93650",
"datePublished": "2026-09-18T18:15:10.080Z",
"dateReserved": "2026-09-18T13:07:36.010Z",
"dateUpdated": "2026-09-18T19:47:52.282Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Common protection mechanisms include:
- Disconnecting the user after a small number of failed attempts
- Implementing a timeout
- Locking out a targeted account
- Requiring a computational task on the user's part.
Mitigation MIT-4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
- Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]
CAPEC-16: Dictionary-based Password Attack
An attacker tries each of the words in a dictionary as passwords to gain access to the system via some user's account. If the password chosen by the user was a word within the dictionary, this attack will be successful (in the absence of other mitigations). This is a specific instance of the password brute forcing attack pattern.
Dictionary Attacks differ from similar attacks such as Password Spraying (CAPEC-565) and Credential Stuffing (CAPEC-600), since they leverage unknown username/password combinations and don't care about inducing account lockouts.
CAPEC-49: Password Brute Forcing
An adversary tries every possible value for a password until they succeed. A brute force attack, if feasible computationally, will always be successful because it will essentially go through all possible passwords given the alphabet used (lower case letters, upper case letters, numbers, symbols, etc.) and the maximum length of the password.
CAPEC-560: Use of Known Domain Credentials
An adversary guesses or obtains (i.e. steals or purchases) legitimate credentials (e.g. userID/password) to achieve authentication and to perform authorized actions under the guise of an authenticated user or service.
CAPEC-565: Password Spraying
In a Password Spraying attack, an adversary tries a small list (e.g. 3-5) of common or expected passwords, often matching the target's complexity policy, against a known list of user accounts to gain valid credentials. The adversary tries a particular password for each user account, before moving onto the next password in the list. This approach assists the adversary in remaining undetected by avoiding rapid or frequent account lockouts. The adversary may then reattempt the process with additional passwords, once enough time has passed to prevent inducing a lockout.
CAPEC-600: Credential Stuffing
An adversary tries known username/password combinations against different systems, applications, or services to gain additional authenticated access. Credential Stuffing attacks rely upon the fact that many users leverage the same username/password combination for multiple systems, applications, and services.
CAPEC-652: Use of Known Kerberos Credentials
An adversary obtains (i.e. steals or purchases) legitimate Kerberos credentials (e.g. Kerberos service account userID/password or Kerberos Tickets) with the goal of achieving authenticated access to additional systems, applications, or services within the domain.
CAPEC-653: Use of Known Operating System Credentials
An adversary guesses or obtains (i.e. steals or purchases) legitimate operating system credentials (e.g. userID/password) to achieve authentication and to perform authorized actions on the system, under the guise of an authenticated user or service. This applies to any Operating System.