Improper restriction of excessive authentication attempts vulnerability in Bahçelievler Muncipality BiHayat App allows Authentication Bypass.
This issue affects BiHayat App: from 2.1.7 before 2.3.
In Audio HAL, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11087632; Issue ID: MSV-8244.
CVE-2026-20512 is a vulnerability in the Audio HAL component of MediaTek chipsets that allows local escalation of privilege due to improper input validation. Exploitation does not require user interaction but requires the attacker to already have System privilege. The vulnerability affects multiple MediaTek chipset models. The CVSS score is 6.7, indicating a medium severity level.
CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to a user account by performing an arbitrary number of authentication attempts when redirect handling is disabled.
A privilege escalation security issue exists within FactoryTalk® Activation Manager. The security issue stems from custom actions in the installer that spawn visible console windows running with SYSTEM privileges during installation or repair operations. An authenticated attacker with Windows credentials could hijack these console windows to obtain a SYSTEM-level command prompt, allowing full access to all files, processes, and system resources.
WatchGuard Dimension version 2.0 has a vulnerability in its web login endpoint where effective rate-limiting or account lockout is not enforced by default. This allows a remote attacker to perform automated password guessing attacks against user accounts. While an account lockout setting exists to block brute-force attempts after a defined number of failures, it is not enabled by default.
The Ebyte NA111-M Firmware version 9013-2-17 lacks rate limiting and account lockout mechanisms for authentication attempts. This vulnerability (CWE-307) enables attackers to perform automated password guessing attacks, potentially leading to unauthorized access. The issue affects password-based authentication and has a CVSS score of 7.5, indicating high severity. No official patch or remediation guidance is currently available, and no exploits are known in the wild.
CVE-2026-18260 is a vulnerability in the Drupal Disable Login Page module that allows brute force attacks due to improper restriction of excessive authentication attempts. Versions from 0.0.0 up to but not including 1.1.4 are affected. The issue has been fixed in version 1.1.4. The vulnerability has a medium severity with a CVSS score of 5.7.
Typebot.io versions up to and including 3.17.1 have a vulnerability in their passwordless email magic-link authentication. The 6-digit login code is generated insecurely with Math.random(), allowing brute force attacks due to a limited keyspace and no effective attempt limits or lockout. Attackers can guess valid codes within their 10-minute lifetime without consuming attempts, enabling account takeover. OAuth or SSO-only deployments without email providers are not affected. This issue is fixed in version 3.18.0.
Punk::Plugin::TOTP versions before 0.05 for Perl have a vulnerability where the second-factor authentication attempt limit can be bypassed by replaying an earlier session cookie. This occurs because the failure count is stored in the session cookie rather than server-side, allowing an attacker to reset the failure count by reusing a previous cookie. Applications using server-side session stores are not affected. The vulnerability allows unlimited guessing of the second factor within the constraints of a separate per-address rate limit.
CVE-2026-21755 is a medium severity vulnerability in HCL Hive version 1.0 caused by improper restriction of excessive authentication attempts. The lack of rate limiting allows attackers to perform brute-force or credential stuffing attacks, potentially leading to unauthorized access or denial of service. No patch or official fix information is provided.
Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated attacker can rotate either header to create a new bucket for each request, bypassing rootRateLimiter, badAuthRateLimiter, getKey(), and the getKeyWithUid() fallback used by public endpoints. This permits repeated POST /users/forgotPasswordEmail and verificationEmail requests, mail bombing registered users, consuming Firebase or SMTP quota, evading brute-force protection, and enabling resource exhaustion. Exploitability of cf-connecting-ip depends on deployment topology, but x-forwarded-for and direct-to-origin paths remain affected when those values are not overwritten by a trusted proxy. No fixed version is available as of this review.
A vulnerability has been found in mangroup dtale up to 3.22.0. This issue affects the function Login of the file dtale/auth.py of the component Login Endpoint. Such manipulation leads to improper restriction of excessive authentication attempts. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
IBM Langflow OSS versions 1.0.0 through 1.9.6 contain a vulnerability due to improper restriction of excessive authentication attempts. This flaw could allow a remote attacker to gain unauthorized access to user accounts without any user interaction. The vulnerability is classified as critical with a CVSS score of 9.1, indicating high impact on confidentiality and integrity. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted without adequate rate limiting or challenge mechanisms, potentially resulting in unintended behavior or security impact under certain conditions.
The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. An attacker can use brute-force methods to obtain gain access to user accounts.
Apache Ranger versions up to and including 2.8.0 contain a vulnerability in the UnixAuth authentication method, which lacks protection against brute-force attacks. UnixAuth is not recommended for production use. The issue is resolved in version 2.9.0, which users are advised to upgrade to.
The miniOrange 2FA WordPress plugin versions prior to 6.2.8 contain a vulnerability that fails to properly limit the number of second-factor authentication attempts. This flaw allows an attacker who already knows a user's password to repeatedly guess the one-time code without restriction, potentially leading to account takeover.
OpenReception's appointment booking software versions prior to 1.0.2 do not throttle failed passphrase login attempts, allowing attackers to perform unlimited guesses against known email addresses. This lack of throttling applies only to the passphrase login path, while the WebAuthn path is properly rate-limited. The vulnerability enables credential stuffing and dictionary attacks, especially against accounts with common or weak passphrases. Version 1.0.2 addresses this issue by implementing throttling on the passphrase login attempts.
OpenReception's appointment booking software versions prior to 1.0.4 have an issue with improper restriction of excessive authentication attempts. The software uses a shared throttle key based on emailHash across all tenants, causing failed authentication attempts in one tenant to affect others. This allows an attacker to cause denial of service by locking out a user across multiple tenants by repeatedly failing PIN challenges. The lockout durations escalate with repeated failures, lasting up to 60 minutes. The issue is patched in version 1.0.4.