CVE-2026-93346: Improper Restriction of Excessive Authentication Attempts in Wazuh wazuh-manager

Wazuh wazuh-manager versions >=4.0.0 and <4.14.8 contain a race condition in the API login throttling logic. The flaw allows unauthenticated attackers to circumvent the max_login_attempts limit by firing concurrent login bursts to the authenticate and run_as endpoints. Each concurrent request passes the block check before failure counts are incremented, effectively enabling unlimited password guessing attempts.

The vulnerability allows attackers to perform unlimited password guessing attempts without being blocked by the login throttling mechanism. This can increase the risk of unauthorized access through brute force attacks. However, there is no indication of privilege escalation, code execution, or other impacts beyond authentication bypass of throttling.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing external rate limiting or monitoring to detect and block concurrent login bursts.