An authentication bypass and missing brute-force protection vulnerability exists in the remote.php/webdav/ endpoint of ownCloud server version 10.16.3. This flaw allows an unauthenticated remote attacker to perform unlimited online password guessing attacks against WebDAV accounts by repeatedly sending HTTP Basic Authentication requests to the WebDAV interface.