Common Weakness Enumeration
CWE-307
AllowedImproper Restriction of Excessive Authentication Attempts
Abstraction: Base · Status: Draft
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
487 vulnerabilities reference this CWE, most recent first.
CVE-2026-111056 (GCVE-0-2026-111056)
Vulnerability from cvelistv5 – Published: 2026-10-19 16:00 – Updated: 2026-10-22 03:02
VLAI
EPSS
VEX
Title
FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint
Summary
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signup returns a distinct unredacted error when the submitted email already exists. The trigger is an unauthenticated request to POST /api/guest/client/create with a target email address. An attacker can compare the guest-signup response for a target email to determine whether the email belongs to an existing FOSSBilling client. Box\Mod\Client\Api\Guest::create returns the error after Client\Service::clientAlreadyExists finds a matching record, and the API response exposes that exception message without redaction. This issue is fixed in version 0.8.7.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-22 03:02 UTC
CWE
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/FOSSBilling/FOSSBilling/securi… | x_refsource_CONFIRM |
| https://github.com/FOSSBilling/FOSSBilling/pull/4234 | x_refsource_MISC |
| https://github.com/FOSSBilling/FOSSBilling/commit… | x_refsource_MISC |
| https://github.com/FOSSBilling/FOSSBilling/releas… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| FOSSBilling | FOSSBilling |
Affected:
>= 0.1.0, < 0.8.7
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111056",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-22T03:02:31.174115Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T03:02:43.261Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "FOSSBilling",
"vendor": "FOSSBilling",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.1.0, \u003c 0.8.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signup returns a distinct unredacted error when the submitted email already exists. The trigger is an unauthenticated request to POST /api/guest/client/create with a target email address. An attacker can compare the guest-signup response for a target email to determine whether the email belongs to an existing FOSSBilling client. Box\\Mod\\Client\\Api\\Guest::create returns the error after Client\\Service::clientAlreadyExists finds a matching record, and the API response exposes that exception message without redaction. This issue is fixed in version 0.8.7."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-204",
"description": "CWE-204: Observable Response Discrepancy",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307: Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:00:57.576Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-x4mh-g4pc-wfc5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-x4mh-g4pc-wfc5"
},
{
"name": "https://github.com/FOSSBilling/FOSSBilling/pull/4234",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FOSSBilling/FOSSBilling/pull/4234"
},
{
"name": "https://github.com/FOSSBilling/FOSSBilling/commit/19f41ff0a45874c7362b7732c8f68db84bc59c55",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FOSSBilling/FOSSBilling/commit/19f41ff0a45874c7362b7732c8f68db84bc59c55"
},
{
"name": "https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.7"
}
],
"source": {
"advisory": "GHSA-x4mh-g4pc-wfc5",
"discovery": "UNKNOWN"
},
"title": "FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-111056",
"datePublished": "2026-10-19T16:00:57.576Z",
"dateReserved": "2026-10-15T12:47:13.664Z",
"dateUpdated": "2026-10-22T03:02:43.261Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110861 (GCVE-0-2026-110861)
Vulnerability from cvelistv5 – Published: 2026-10-14 22:52 – Updated: 2026-10-20 02:26
VLAI
EPSS
VEX
Title
Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition
Summary
Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 02:26 UTC
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/better-auth/better-auth/securi… | vendor-advisory |
| https://www.vulncheck.com/advisories/better-auth-… | third-party-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| better-auth | drizzle-adapter |
Affected:
1.6.17 , < 1.7.7
(semver)
Unaffected: 1.7.7 (semver) |
|
| better-auth | kysely-adapter |
Affected:
1.6.17 , < 1.7.0
(semver)
Unaffected: 1.7.0 (semver) |
|
| better-auth | better-auth |
Affected:
1.6.17 , < 1.7.7
(semver)
Unaffected: 1.7.7 (semver) |
Date Public
2026-09-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110861",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T02:26:21.724147Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T02:26:30.363Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40better-auth/drizzle-adapter",
"product": "drizzle-adapter",
"vendor": "better-auth",
"versions": [
{
"lessThan": "1.7.7",
"status": "affected",
"version": "1.6.17",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.7.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40better-auth/kysely-adapter",
"product": "kysely-adapter",
"vendor": "better-auth",
"versions": [
{
"lessThan": "1.7.0",
"status": "affected",
"version": "1.6.17",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.7.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/better-auth",
"product": "better-auth",
"vendor": "better-auth",
"versions": [
{
"lessThan": "1.7.7",
"status": "affected",
"version": "1.6.17",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.7.7",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.7.7",
"versionStartIncluding": "1.6.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "designorant"
}
],
"datePublic": "2026-09-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T22:52:45.713Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-44jh-23m7-hpcf)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-44jh-23m7-hpcf"
},
{
"name": "VulnCheck Advisory: Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/better-auth-drizzle-adapter-1.6.17-before-1.7.7-rate-limit-bypass-via-race-condition"
}
],
"title": "Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110861",
"datePublished": "2026-10-14T22:52:45.713Z",
"dateReserved": "2026-10-14T22:18:33.239Z",
"dateUpdated": "2026-10-20T02:26:30.363Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110770 (GCVE-0-2026-110770)
Vulnerability from cvelistv5 – Published: 2026-10-14 18:47 – Updated: 2026-11-09 16:33
VLAI
EPSS
VEX
Title
Databasus 3.7.0 through 3.61.0 Account Takeover via Password Reset Brute-Force
Summary
Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-digit code for a known email, then guess it without rate limiting, lockout, or invalidation to take over accounts, including administrators.
Severity
8.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 15:38 UTC
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/databasus-passwo… | technical-descriptionexploit |
| https://github.com/databasus/databasus/blob/9ee25… | technical-description |
| https://github.com/databasus/databasus | product |
| https://www.vulncheck.com/advisories/databasus-3.… | third-party-advisory |
Impacted products
Date Public
2026-10-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110770",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:38:00.708393Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T16:33:00.852Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/databasus/databasus",
"defaultStatus": "unaffected",
"product": "databasus",
"repo": "https://github.com/databasus/databasus",
"vendor": "databasus",
"versions": [
{
"lessThanOrEqual": "3.61.0",
"status": "affected",
"version": "3.7.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-digit code for a known email, then guess it without rate limiting, lockout, or invalidation to take over accounts, including administrators."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T18:47:54.543Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/databasus-password-reset-code-brute-force"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/databasus/databasus/blob/9ee25ed8f47b1b537468417e1bb52ed2d76218a0/backend/internal/features/users/services/user_services.go#L637"
},
{
"tags": [
"product"
],
"url": "https://github.com/databasus/databasus"
},
{
"name": "VulnCheck Advisory: Databasus 3.7.0 through 3.61.0 Account Takeover via Password Reset Brute-Force",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/databasus-3.7.0-through-3.61.0-account-takeover-via-password-reset-brute-force"
}
],
"title": "Databasus 3.7.0 through 3.61.0 Account Takeover via Password Reset Brute-Force",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110770",
"datePublished": "2026-10-14T18:47:54.543Z",
"dateReserved": "2026-10-14T17:27:35.255Z",
"dateUpdated": "2026-11-09T16:33:00.852Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109949 (GCVE-0-2026-109949)
Vulnerability from cvelistv5 – Published: 2026-10-13 13:27 – Updated: 2026-10-13 16:43
VLAI
EPSS
VEX
Title
FreeRDP 3.0.0 before 3.32.0 PIN Brute-Force via Virtual Smartcard
Summary
FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset attempts, enabling unbounded online brute-forcing of the configured smartcard PIN.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 16:21 UTC
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/FreeRDP/FreeRDP/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/freerdp-3.0.… | third-party-advisory |
Impacted products
Date Public
2026-09-29 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109949",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T16:21:53.526573Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:43:58.209Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FreeRDP",
"vendor": "FreeRDP",
"versions": [
{
"lessThan": "3.32.0",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.32.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.0",
"versionStartIncluding": "3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kushalkhemka"
},
{
"lang": "en",
"type": "finder",
"value": "opensec-intelligence"
},
{
"lang": "en",
"type": "finder",
"value": "mayank-jangid-moon"
},
{
"lang": "en",
"type": "finder",
"value": "skigeek16"
}
],
"datePublic": "2026-09-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset attempts, enabling unbounded online brute-forcing of the configured smartcard PIN."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T13:27:15.776Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-chh2-527f-x255)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-chh2-527f-x255"
},
{
"name": "VulnCheck Advisory: FreeRDP 3.0.0 before 3.32.0 PIN Brute-Force via Virtual Smartcard",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.0-pin-brute-force-via-virtual-smartcard"
}
],
"title": "FreeRDP 3.0.0 before 3.32.0 PIN Brute-Force via Virtual Smartcard",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109949",
"datePublished": "2026-10-13T13:27:15.776Z",
"dateReserved": "2026-10-13T11:25:25.213Z",
"dateUpdated": "2026-10-13T16:43:58.209Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108580 (GCVE-0-2026-108580)
Vulnerability from cvelistv5 – Published: 2026-10-10 15:57 – Updated: 2026-10-13 18:57
VLAI
EPSS
VEX
Title
AniWorld Downloader before 5.3.0 WebUI Login Brute Force via /login
Summary
AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in the WebUI /login POST handler that allows unauthenticated attackers to guess passwords without throttling. Attackers can enumerate usernames through verify_user response timing and brute-force passwords on exposed WebUI instances to take over accounts.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 18:56 UTC
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/phoenixthrush/AniWorld-Downloa… | issue-tracking |
| https://github.com/phoenixthrush/AniWorld-Downloa… | patch |
| https://github.com/phoenixthrush/AniWorld-Downloa… | release-notes |
| https://hackmd.io/@haind/aniworld-login-brute-force | third-party-advisory |
| https://github.com/phoenixthrush/AniWorld-Downloa… | technical-description |
| https://www.vulncheck.com/advisories/aniworld-dow… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| phoenixthrush | AniWorld Downloader |
Affected:
0 , < 5.3.0
(semver)
|
Date Public
2026-10-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108580",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T18:56:48.819801Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:57:02.001Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/aniworld",
"product": "AniWorld Downloader",
"repo": "https://github.com/phoenixthrush/AniWorld-Downloader",
"vendor": "phoenixthrush",
"versions": [
{
"lessThan": "5.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "SiroxCW"
},
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in the WebUI /login POST handler that allows unauthenticated attackers to guess passwords without throttling. Attackers can enumerate usernames through verify_user response timing and brute-force passwords on exposed WebUI instances to take over accounts."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T15:57:49.256Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/phoenixthrush/AniWorld-Downloader/issues/334"
},
{
"tags": [
"patch"
],
"url": "https://github.com/phoenixthrush/AniWorld-Downloader/commit/3c070bd10665377308a3092e11933681c18a5fd1"
},
{
"name": "AniWorld Downloader v.5.3.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/phoenixthrush/AniWorld-Downloader/releases/tag/v.5.3.0"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haind/aniworld-login-brute-force"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/phoenixthrush/AniWorld-Downloader/blob/bb13599d17937fdb4df2df699024bc233f0656f2/src/aniworld/web/auth.py#L239-L256"
},
{
"name": "VulnCheck Advisory: AniWorld Downloader before 5.3.0 WebUI Login Brute Force via /login",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/aniworld-downloader-before-5.3.0-webui-login-brute-force-via-login"
}
],
"title": "AniWorld Downloader before 5.3.0 WebUI Login Brute Force via /login",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-108580",
"datePublished": "2026-10-10T15:57:49.256Z",
"dateReserved": "2026-10-10T15:51:34.830Z",
"dateUpdated": "2026-10-13T18:57:02.001Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108163 (GCVE-0-2026-108163)
Vulnerability from cvelistv5 – Published: 2026-10-10 13:55 – Updated: 2026-10-14 16:03
VLAI
EPSS
VEX
Title
Pingvin Share X before 1.22.0 Ineffective Authentication Rate Limiting via Throttler TTL
Summary
Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted as milliseconds. Unauthenticated attackers can send effectively unthrottled requests to /api/auth/signIn, /api/auth/signIn/totp and /api/auth/resetPassword to brute-force passwords and TOTP codes.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 14:53 UTC
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/smp46/pingvin-share-x/security… | vendor-advisory |
| https://github.com/smp46/pingvin-share-x/commit/d… | patch |
| https://github.com/smp46/pingvin-share-x/releases… | release-notes |
| https://github.com/smp46/pingvin-share-x/blob/68e… | technical-description |
| https://github.com/smp46/pingvin-share-x | product |
| https://www.vulncheck.com/advisories/pingvin-shar… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smp46 | pingvin-share-x |
Affected:
0 , < 1.22.0
(semver)
|
Date Public
2026-08-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108163",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T14:53:27.770630Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T16:03:55.032Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/smp46/pingvin-share-x",
"product": "pingvin-share-x",
"vendor": "smp46",
"versions": [
{
"lessThan": "1.22.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mat\u00e9o Florian Callec"
}
],
"datePublic": "2026-08-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted as milliseconds. Unauthenticated attackers can send effectively unthrottled requests to /api/auth/signIn, /api/auth/signIn/totp and /api/auth/resetPassword to brute-force passwords and TOTP codes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T13:55:14.177Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-7gx2-g6x2-7mjg)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/smp46/pingvin-share-x/security/advisories/GHSA-7gx2-g6x2-7mjg"
},
{
"tags": [
"patch"
],
"url": "https://github.com/smp46/pingvin-share-x/commit/dc0aa5f66287038d5f919e74948462f994b1d6b1"
},
{
"name": "pingvin-share-x v1.22.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/smp46/pingvin-share-x/releases/tag/v1.22.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/smp46/pingvin-share-x/blob/68ebf191fe1362592ffd5517e662f087e36c10b2/backend/src/auth/auth.controller.ts#L45-L50"
},
{
"tags": [
"product"
],
"url": "https://github.com/smp46/pingvin-share-x"
},
{
"name": "VulnCheck Advisory: Pingvin Share X before 1.22.0 Ineffective Authentication Rate Limiting via Throttler TTL",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pingvin-share-x-before-1.22.0-ineffective-authentication-rate-limiting-via-throttler-ttl"
}
],
"title": "Pingvin Share X before 1.22.0 Ineffective Authentication Rate Limiting via Throttler TTL",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-108163",
"datePublished": "2026-10-10T13:55:14.177Z",
"dateReserved": "2026-10-09T15:41:44.133Z",
"dateUpdated": "2026-10-14T16:03:55.032Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108109 (GCVE-0-2026-108109)
Vulnerability from cvelistv5 – Published: 2026-10-09 14:33 – Updated: 2026-10-09 17:26
VLAI
EPSS
VEX
Title
PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code
Summary
PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.
Severity
9.1 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 17:25 UTC
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/hotspotbilling/phpnuxbill/secu… | vendor-advisory |
| https://github.com/hotspotbilling/phpnuxbill/comm… | patch |
| https://github.com/hotspotbilling/phpnuxbill/blob… | technical-description |
| https://github.com/hotspotbilling/phpnuxbill | product |
| https://www.vulncheck.com/advisories/phpnuxbill-t… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hotspotbilling | phpnuxbill |
Affected:
0 , ≤ 2025.3.20
(custom)
|
Date Public
2026-08-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108109",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T17:25:00.595911Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T17:26:03.792Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-337r-rrrc-r559"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "phpnuxbill",
"vendor": "hotspotbilling",
"versions": [
{
"lessThanOrEqual": "2025.3.20",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "tonghuaroot"
},
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-08-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T14:33:32.201Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-337r-rrrc-r559)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-337r-rrrc-r559"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/hotspotbilling/phpnuxbill/commit/c3c2a92d468af91136d747b75142ed72f10320cc"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/hotspotbilling/phpnuxbill/blob/2025.3.13/system/controllers/forgot.php#L41"
},
{
"tags": [
"product"
],
"url": "https://github.com/hotspotbilling/phpnuxbill"
},
{
"name": "VulnCheck Advisory: PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/phpnuxbill-through-2025.3.20-account-takeover-via-brute-forceable-password-reset-code"
}
],
"title": "PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-108109",
"datePublished": "2026-10-09T14:33:32.201Z",
"dateReserved": "2026-10-09T13:44:40.883Z",
"dateUpdated": "2026-10-09T17:26:03.792Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107638 (GCVE-0-2026-107638)
Vulnerability from cvelistv5 – Published: 2026-10-08 14:10 – Updated: 2026-10-08 18:01
VLAI
EPSS
VEX
Title
pH7Builder before 18.5.0 2FA Brute Force via VerificationCodeFormProcess.php
Summary
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit verification codes to VerificationCodeFormProcess.php to take over member, affiliate, or administrator accounts.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 18:01 UTC
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pH7Software/pH7-Social-Dating-… | patch |
| https://github.com/pH7Software/pH7-Social-Dating-… | technical-description |
| https://github.com/pH7Software/pH7-Social-Dating-CMS | product |
| https://www.vulncheck.com/advisories/ph7builder-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ph7software | ph7builder |
Affected:
0 , < 18.5.0
(semver)
Unaffected: 18.5.0 (semver) |
Date Public
2026-07-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107638",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T18:01:40.593351Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T18:01:47.983Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/ph7software/ph7builder",
"product": "ph7builder",
"vendor": "ph7software",
"versions": [
{
"lessThan": "18.5.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "18.5.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Haluk Baran AKBULUT (CyberMap Group)"
}
],
"datePublic": "2026-07-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit verification codes to VerificationCodeFormProcess.php to take over member, affiliate, or administrator accounts."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T14:10:35.297Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/44970860b82f8af867de9d2832081485f5dbe578"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.4.1/_protected/app/system/modules/two-factor-auth/forms/processing/VerificationCodeFormProcess.php#L34-L60"
},
{
"tags": [
"product"
],
"url": "https://github.com/pH7Software/pH7-Social-Dating-CMS"
},
{
"name": "VulnCheck Advisory: pH7Builder before 18.5.0 2FA Brute Force via VerificationCodeFormProcess.php",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ph7builder-before-18.5.0-2fa-brute-force-via-verificationcodeformprocess-php"
}
],
"title": "pH7Builder before 18.5.0 2FA Brute Force via VerificationCodeFormProcess.php",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107638",
"datePublished": "2026-10-08T14:10:35.297Z",
"dateReserved": "2026-10-08T14:06:00.383Z",
"dateUpdated": "2026-10-08T18:01:47.983Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107256 (GCVE-0-2026-107256)
Vulnerability from cvelistv5 – Published: 2026-10-30 03:09 – Updated: 2026-11-06 13:16
VLAI
EPSS
VEX
Title
Shield - Moderately critical - Access bypass - SA-CONTRIB-2026-248
Summary
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force. This issue affects Shield versions: from 0.0.0 to 1.9.0.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 13:16 UTC
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
drupal
CNA
References
1 reference
Date Public
2026-10-21 18:07
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-107256",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T13:16:42.437709Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T13:16:59.381Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.drupal.org/project/shield",
"product": "Shield",
"repo": "https://git.drupalcode.org/project/shield",
"vendor": "Drupal",
"versions": [
{
"lessThan": "1.9.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Pierre Rudloff (prudloff)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Bram Driesen (bramdriesen)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Merlin Axel Rutz (geek-merlin)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jakob P (japerry)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ivo Van Geertruyen (mr.baileys)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ra M\u00c3\u00a4nd (ram4nd)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Swan Kalata (akalata)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Greg Knaddison (greggles)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Juraj Nemec (poker10)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Pierre Rudloff (prudloff)"
}
],
"datePublic": "2026-10-21T18:07:51.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force. This issue affects Shield versions: from 0.0.0 to 1.9.0."
}
],
"impacts": [
{
"capecId": "CAPEC-112",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-112 Brute Force"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307 Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T03:09:20.371Z",
"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"shortName": "drupal"
},
"references": [
{
"url": "https://www.drupal.org/sa-contrib-2026-248"
}
],
"title": "Shield - Moderately critical - Access bypass - SA-CONTRIB-2026-248"
}
},
"cveMetadata": {
"assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"assignerShortName": "drupal",
"cveId": "CVE-2026-107256",
"datePublished": "2026-10-30T03:09:20.371Z",
"dateReserved": "2026-10-07T15:25:19.994Z",
"dateUpdated": "2026-11-06T13:16:59.381Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107145 (GCVE-0-2026-107145)
Vulnerability from cvelistv5 – Published: 2026-10-27 09:34 – Updated: 2026-11-04 14:58 X_Open Source
VLAI
EPSS
VEX
Title
Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator
Summary
The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system.
This issue was fixed in commit 4640889.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 14:51 UTC
CWE
- CWE-307 - Improper restriction of excessive authentication attempts
Assigner
CERT-PL
CNA
References
2 references
| URL | Tags |
|---|---|
| https://cert.pl/en/posts/2026/10/CVE-2026-107145 | third-party-advisory |
| https://github.com/alexandregz/twofactor_gauthent… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| alexandregz | twofactor_gauthenticator |
Affected:
0 , < 4640889
(git)
cpe:2.3:a:alexandregz:twofactor_gauthenticator:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107145",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T14:51:14.610711Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T14:58:27.010Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"product": "twofactor_gauthenticator",
"repo": "https://github.com/alexandregz/twofactor_gauthenticator",
"vendor": "alexandregz",
"versions": [
{
"lessThan": "4640889",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:alexandregz:twofactor_gauthenticator:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4640889",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marek Figielski (Vanilla.pl)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eThe twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user\u0027s password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003eThis issue was fixed in commit 4640889."
}
],
"value": "The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user\u0027s password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system.\n\n\n\n\nThis issue was fixed in commit 4640889."
}
],
"impacts": [
{
"capecId": "CAPEC-112",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-112 Brute Force"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307 Improper restriction of excessive authentication attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T09:34:36.692Z",
"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"shortName": "CERT-PL"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://cert.pl/en/posts/2026/10/CVE-2026-107145"
},
{
"tags": [
"patch"
],
"url": "https://github.com/alexandregz/twofactor_gauthenticator/blob/master/CHANGES-2FA-SECURITY.en.md"
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"title": "Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"assignerShortName": "CERT-PL",
"cveId": "CVE-2026-107145",
"datePublished": "2026-10-27T09:34:36.692Z",
"dateReserved": "2026-10-07T08:44:03.177Z",
"dateUpdated": "2026-11-04T14:58:27.010Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Common protection mechanisms include:
- Disconnecting the user after a small number of failed attempts
- Implementing a timeout
- Locking out a targeted account
- Requiring a computational task on the user's part.
Mitigation MIT-4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
- Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]
CAPEC-16: Dictionary-based Password Attack
An attacker tries each of the words in a dictionary as passwords to gain access to the system via some user's account. If the password chosen by the user was a word within the dictionary, this attack will be successful (in the absence of other mitigations). This is a specific instance of the password brute forcing attack pattern.
Dictionary Attacks differ from similar attacks such as Password Spraying (CAPEC-565) and Credential Stuffing (CAPEC-600), since they leverage unknown username/password combinations and don't care about inducing account lockouts.
CAPEC-49: Password Brute Forcing
An adversary tries every possible value for a password until they succeed. A brute force attack, if feasible computationally, will always be successful because it will essentially go through all possible passwords given the alphabet used (lower case letters, upper case letters, numbers, symbols, etc.) and the maximum length of the password.
CAPEC-560: Use of Known Domain Credentials
An adversary guesses or obtains (i.e. steals or purchases) legitimate credentials (e.g. userID/password) to achieve authentication and to perform authorized actions under the guise of an authenticated user or service.
CAPEC-565: Password Spraying
In a Password Spraying attack, an adversary tries a small list (e.g. 3-5) of common or expected passwords, often matching the target's complexity policy, against a known list of user accounts to gain valid credentials. The adversary tries a particular password for each user account, before moving onto the next password in the list. This approach assists the adversary in remaining undetected by avoiding rapid or frequent account lockouts. The adversary may then reattempt the process with additional passwords, once enough time has passed to prevent inducing a lockout.
CAPEC-600: Credential Stuffing
An adversary tries known username/password combinations against different systems, applications, or services to gain additional authenticated access. Credential Stuffing attacks rely upon the fact that many users leverage the same username/password combination for multiple systems, applications, and services.
CAPEC-652: Use of Known Kerberos Credentials
An adversary obtains (i.e. steals or purchases) legitimate Kerberos credentials (e.g. Kerberos service account userID/password or Kerberos Tickets) with the goal of achieving authenticated access to additional systems, applications, or services within the domain.
CAPEC-653: Use of Known Operating System Credentials
An adversary guesses or obtains (i.e. steals or purchases) legitimate operating system credentials (e.g. userID/password) to achieve authentication and to perform authorized actions on the system, under the guise of an authenticated user or service. This applies to any Operating System.