This vulnerability, classified as CWE-307, affects CodePeople Appointment Hour Booking versions up to 1.4.56. It involves improper restriction of excessive authentication attempts, meaning the application does not sufficiently limit repeated login attempts. This can allow attackers to perform brute force or credential stuffing attacks more easily, potentially disrupting client functionality. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and an impact limited to integrity.

The vulnerability allows attackers to perform excessive authentication attempts without proper restriction, which can lead to removal or disruption of important client functionality. There is no impact on confidentiality or availability reported. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider implementing external rate limiting or account lockout policies at the infrastructure or application firewall level to mitigate excessive authentication attempts.