PT-2026-111573 · Git+1 · Wazuh+1
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers to bypass max login attempts by sending concurrent requests. Attackers can fire concurrent login bursts to the authenticate and run as endpoints, each passing the block check before failures are counted, enabling unlimited password guessing.
Exploit
Fix
Improper Restriction of Excessive Authentication Attempts
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Wazuh
Wazuh Manager