PaperCut NG/MF contains an improper restriction of excessive authentication attempts (CWE-307) vulnerability in its login component. This flaw permits unauthenticated remote attackers to conduct unrestricted brute-force or credential-stuffing attacks because the system fails to enforce account lockout or rate-limiting mechanisms under certain configurations. The vulnerability is identified as CVE-2026-8793 with a CVSS 4.0 base score of 6.9, indicating a medium level of risk. No vendor advisory or patch information is currently provided, and the affected versions are not explicitly stated.

An attacker can perform unlimited authentication attempts remotely without triggering lockout or rate-limiting protections, increasing the risk of successful brute-force or credential-stuffing attacks. This could lead to unauthorized access if valid credentials are compromised. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider implementing external protections such as network-level rate limiting or multi-factor authentication to mitigate brute-force risks.