PT-2026-111573 · Git+1 · Wazuh+1
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers to bypass max login attempts by sending concurrent requests. Attackers can fire concurrent login bursts to the authenticate and run as endpoints, each passing the block check before failures are counted, enabling unlimited password guessing.
Exploit
Correção
Improper Restriction of Excessive Authentication Attempts
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Wazuh
Wazuh Manager