Threats tagged 'ghsa-gwwm-v499-xvfh'

Zenitel Connect versions before 1.11.0 contain a vulnerability in the WAMP-CRA authentication path that allows unlimited authentication attempts without account lockout or rate limiting. This flaw enables remote attackers to guess user passwords via brute force. However, exploitation is limited by a strict password policy requiring at least 12 characters with mixed character types. The vulnerable authentication path is removed in version 1.11.0.