The WebSocket Application Programming Interface in monta.app lacks restrictions on the number of authentication requests, classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts). This absence of rate limiting may allow attackers to conduct denial-of-service attacks or brute-force attempts to gain unauthorized access. The CVSS v3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or integrity impact, but high impact on availability.

The vulnerability allows attackers to flood the authentication mechanism via WebSocket requests, potentially causing denial-of-service conditions or enabling brute-force attacks to guess credentials. This impacts the availability of the service but does not compromise confidentiality or integrity according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing external rate limiting or monitoring mechanisms to detect and block excessive authentication attempts on the WebSocket API.