CVE-2024-55008 describes a denial-of-service vulnerability in JATOS 3.9.4's authentication system. The vulnerability arises because the account lockout mechanism triggers after 3 incorrect login attempts per minute, locking the user account indefinitely. Since the lockout is account-based and not IP-based, an attacker can cause denial of service to any user by repeatedly submitting failed login attempts against that user's account, effectively preventing legitimate access.

The vulnerability allows an unauthenticated attacker to cause a denial of service by locking out legitimate users from their accounts indefinitely. This impacts availability but does not affect confidentiality or integrity. There is no indication of privilege escalation or data compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing additional controls such as monitoring for abnormal failed login attempts or temporarily disabling account lockout policies if feasible. Avoid relying solely on the current account lockout mechanism to prevent denial of service.