FileRise versions prior to 3.23.0 have an authentication flaw where failed TOTP verification attempts are tracked per session rather than account-wide. This allows an attacker with valid primary credentials to bypass the intended five-attempt limit for second-factor authentication by restarting login attempts in new sessions. The issue is resolved in version 3.23.0.
FileRise versions prior to 3.21.0 have an authentication weakness where failed login attempts are tracked only by source IP and username combination. This allows an unauthenticated attacker to bypass intended rate limits by rotating usernames, enabling password spraying attacks from a single source beyond the expected limit. The issue is fixed in version 3.21.0.
CVE-2026-93637 is a low-severity vulnerability in Zimbra Collaboration Suite versions up to 10.1.21. It involves an authentication rate-limit bypass via GraphQL aliases, allowing unauthenticated attackers to perform multiple password guesses in a single HTTP request without incrementing the source-IP failure counter.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 have a vulnerability involving improper restriction of excessive authentication attempts. This flaw allows an unauthenticated remote attacker to potentially bypass protection mechanisms, elevate privileges, and gain unauthorized access. The vulnerability is tracked as CVE-2026-76779 and has a high severity rating with a CVSS score of 7.4.
### **Impact**
An unauthenticated attacker who knows an account’s email address or username could trigger Payload’s account lockout mechanism and prevent that user from signing in.
You are affected if:
* Using an affected Payload version with an auth-enabled collection that uses local authentication and account lockout.
Applications that do not use Payload local authentication are not affected.
### **Patches**
Successful password resets now clear the account’s lockout state. The forgot-password flow also enforces a configurable minimum interval between reset emails, which defaults to 15 seconds.
Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.
CVE-2026-105638 affects Plane, an open-source project management tool, prior to version 1.4.0. The vulnerability involves improper restriction of excessive authentication attempts on the magic-code email login, which uses a six-digit numeric OTP with about 20 bits of entropy. The verification process lacks per-code failed-attempt counters, does not invalidate Redis entries or lock email addresses after incorrect attempts, and is not protected by configured rate limiting middleware. This flaw allows attackers to attempt unlimited OTP guesses without triggering throttling or lockout mechanisms. The issue is fixed in Plane version 1.4.0.
CVE-2026-97363 is a vulnerability in the Monta monta.app WebSocket API where there are no restrictions on the number of authentication requests. This lack of rate limiting can enable attackers to perform denial-of-service or brute-force attacks. The vulnerability has a high severity rating with a CVSS score of 7.5, primarily impacting availability. No affected versions or patches are explicitly stated in the available data.
CVE-2026-102825 is a vulnerability in the Eugeny russh Rust SSH client and server library where authentication attempt limits are not properly enforced prior to version 0.62.6. This allows an unauthenticated remote client to bypass the configured maximum authentication attempts on a single connection, potentially increasing the risk of online guessing attacks and additional backend workload. The issue is fixed in version 0.62.6.
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against the MFA verification flow, making brute-force compromise of the second factor and subsequent account takeover possible. This issue is fixed in version 11.0.8.
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightrag_server.py does not impose a rate limit, account lockout, delay, or counter for failed authentication attempts. A network attacker can submit password guesses at full request speed until a valid account password is found. Successful credential recovery grants authenticated access to documents, the knowledge graph, and administrative operations. This issue is fixed in version 1.5.5.
9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-supplied X-9r-Real-Ip value as the bucket key in getClientIp, checkLock, and recordFail in src/lib/auth/loginLimiter.js for POST /api/auth/login. A remote unauthenticated attacker can rotate the header on every password guess so each request uses a new failed-attempt bucket and the five-attempt progressive lockout never returns HTTP 429. This permits unthrottled password guessing against the dashboard login and can lead to an administrative session if the password is recovered. This issue is fixed in version 0.5.6.
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/login_with_code/:id endpoint accepts a nine-digit SSO authentication code with a ten-minute lifetime without applying limiterLoginBruteForce. An unauthenticated attacker who targets a user during an active SSO login can make unlimited guesses, and a correct code returns a full session token that permits access to and modification of the user's notes, notebooks, and account settings. This issue is fixed in version 3.7.2.
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/app/sync/register` accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP, `SyncClientsManager.register()` calls `updateAccesses(user, ip, false)`, which hits a freeze branch that writes `passwordAttempts` back unchanged. The counter never reaches `USER_MAX_PASSWORD_ATTEMPTS` (10) and the lockout gate never fires. A successful guess returns a `{clientId, clientToken}` pair. The token can be exchanged via `POST /api/app/sync/auth/cookie` for a full JWT. While the code is valid, the attacker can also call `POST /api/auth/2fa/disable` to permanently remove MFA. Version 2.4.0 patches the issue.
Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. internal/controller/user_controller.go loginHandler passes each attacker-controlled identifier to internal/service/auth_service.go RecordLoginAttempt, which invokes lockdownMode after the map reaches its cap. IsAccountLocked checks that global state before validating unrelated accounts, causing valid users to receive HTTP 429 until auth.loginTimeout expires, approximately 300 seconds by default. The attack can be repeated, but existing authenticated sessions are not invalidated. This issue is fixed in version 5.1.0.
HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an unauthenticated attacker to execute sustained brute-force attacks against the login interface, resulting in unauthorized system access.
By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see https://docs.azul.com/payara/technical-documentation/payara-server-documentation/security-guide/administering-system-security.html .
Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its RateLimiter only when the number POST or GET parameter is supplied. An unauthenticated attacker can submit couponCode values to actionUpdateCart for the session-based cart while omitting number, preventing creation of the IP rate-limit identity and allowing unlimited automated coupon-code guessing and enumeration. This issue is fixed in versions 4.11.2 and 5.6.5.
Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers can gain access to valid accounts through a large number of login attempts.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to client-side request forgery.