CVE-2026-19897 is a vulnerability in the mangroup dtale software up to version 3.22.0, specifically in the Login endpoint implemented in dtale/auth.py. The flaw allows an attacker to bypass proper restrictions on excessive authentication attempts, potentially enabling brute force or similar attacks. The attack vector is network-based with high complexity and no privileges or user interaction required. Although the exploit has been publicly disclosed, no official patch or vendor response has been recorded. The vulnerability is classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts).

The vulnerability allows remote attackers to attempt excessive authentication attempts without proper restriction, which could lead to information disclosure or account enumeration. However, the CVSS score of 3.7 and the low severity rating indicate the impact is limited to confidentiality with no integrity or availability impact. Exploitation is difficult due to high complexity.

No official patch or fix is currently available, and the vendor has not responded to the issue report. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, organizations should consider implementing external rate limiting or monitoring to mitigate excessive authentication attempts.