This vulnerability exists in the requestHandler function of the app/vmauth/main.go file in VictoriaMetrics up to version 1.146.0. It involves improper restriction of excessive authentication attempts at the VMAuth Authentication Endpoint, which could allow an attacker to attempt multiple authentications without proper throttling or blocking. The vulnerability can be exploited remotely, though the attack complexity is high and exploitability is difficult. Public exploit code is available. The issue is addressed by upgrading to version 1.147.0, with the patch identified by commit 119ba0fb5be8024d50c5ba946599b2e69e8803ea.

The vulnerability allows an attacker to bypass proper rate limiting or restriction on authentication attempts, potentially leading to brute force or credential stuffing attacks. However, the attack complexity is high and exploitability is difficult, reducing the likelihood of successful exploitation. No direct privilege escalation or data compromise is described.

Upgrade VictoriaMetrics to version 1.147.0 or later, which contains the official fix for this vulnerability. No other mitigations are specified. Patch status is confirmed by the vendor recommendation to upgrade.