A race condition exists in the API login throttling mechanism. This allows unauthenticated attackers to bypass the `max login attempts` limit by sending concurrent requests. By firing bursts of simultaneous login attempts to the 'authenticate' and 'run as' endpoints, an attacker can pass the block check before previous failures are recorded, facilitating unlimited password guessing.