This vulnerability affects the Login endpoint of mangroup dtale (versions up to 3.22.0) due to improper restriction of excessive authentication attempts. The flaw resides in the dtale/auth.py file's Login function, which does not adequately limit repeated authentication attempts, potentially enabling attackers to perform brute force or credential stuffing attacks remotely. The exploitability is considered difficult due to high complexity, and no privilege or user interaction is required. The vulnerability was responsibly disclosed to the project, but no response or remediation has been issued yet.

An attacker can remotely attempt excessive authentication attempts without effective restriction, increasing the risk of brute force or credential stuffing attacks. This could lead to unauthorized access if valid credentials are discovered. The complexity of exploitation is high, and no known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. In the meantime, implementing external rate limiting or multi-factor authentication may help mitigate risk.