CWE-307— Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.— MITRE CWE catalog
757 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-307page 16 of 16
- CVE-2026-47203LOWCVSS 2.9EG 2.92026-05-29
Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In versions 4.38.0 through 4.39.19, when a user authenticates via Basic Auth…
- CVE-2024-42176LOWCVSS 2.6EG 2.62025-03-19
HCL MyXalytics is affected by concurrent login vulnerability. A concurrent login vulnerability occurs when simultaneous active sessions are allowed for a single credential allowing an attacker to potentially obtain access to a user's accou…
- CVE-2024-32771LOWCVSS 2.6EG 2.62024-09-06
An improper restriction of excessive authentication attempts vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local network authenticated administrators to perfor…
- CVE-2026-77057LOWCVSS 2.3EG 2.32026-10-26
boneIO Black does not limit authentication attempts on its web interface (POST /api/login) or SSH service, and does not enforce password complexity. An unauthenticated remote attacker can make unlimited brute-force login attempts, potentia…
- CVE-2025-24806LOWCVSS 2.3EG 2.32025-02-19
Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. If users are allowed to sign in via both username and email the regulation s…
- CVE-2025-52916LOWCVSS 2.2EG 2.22025-06-21
Yealink RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force enumeration (last five digits).
- CVE-2025-26862UnratedEG not assessed2025-10-27
Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may enable brute force login attacks.
Map vulnerabilities like CWE-307 to your infrastructure
EchelonGraph correlates every CVE — across CWE-307 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →