CVE-2026-32825 is an improper restriction of excessive authentication attempts vulnerability (CWE-307) in dataCycle-CORE, a data management system. Versions up to 25.07.3 allow unlimited password guesses on both the HTML login flow (/users/sign_in) and the JSON API login endpoint (/api/v4/auth/login). Although the Devise :lockable module is enabled, lock and unlock strategies are explicitly disabled, and no rate limiting or throttling is implemented in the Rails code. This flaw permits attackers to perform continuous password guessing without temporary lockout, increasing the risk of account compromise. Successful authentication yields a normal session cookie or a fresh JWT token, facilitating unauthorized access. The API endpoint is particularly vulnerable to automated attacks due to the absence of CSRF token requirements. The issue is patched in version 26.06.08.

The vulnerability allows attackers to perform unlimited password guessing attempts against valid user accounts without triggering lockout or throttling mechanisms. This increases the risk of successful credential guessing, leading to unauthorized access to user accounts. Compromise via the HTML login flow results in a valid session cookie, while compromise via the API login endpoint yields a fresh JWT token. The API endpoint's lack of CSRF protection makes automated attacks easier. There is no indication of known exploits in the wild at this time.

A fixed version (26.06.08) is available that addresses this vulnerability by presumably enabling proper lockout or throttling mechanisms. Users should upgrade to version 26.06.08 or later to remediate this issue. Until upgraded, no official temporary fixes or workarounds are documented. Implementing external rate limiting or monitoring for suspicious login activity may help mitigate risk in the interim.