CVE-2026-21755: CWE-307 Improper restriction of excessive authentication attempts in HCLSoftware HCL Hive

HCL Hive version 1.0 suffers from CWE-307, improper restriction of excessive authentication attempts, due to missing rate limiting controls. This vulnerability enables attackers to repeatedly attempt authentication without restriction, increasing the risk of unauthorized access through brute-force or credential stuffing attacks. Additionally, this flaw could be exploited to cause denial of service by overwhelming the authentication mechanism. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact.

An attacker can exploit the missing rate limiting to perform brute-force or credential stuffing attacks against HCL Hive 1.0, potentially gaining unauthorized access or causing denial of service by exhausting authentication resources. The integrity of the system may be impacted, but confidentiality and availability impacts are not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing external rate limiting or monitoring to detect and block excessive authentication attempts.