CWE-799.

Campcodes Bitcoin Wallet System ForgotPasswordController.php random_int excessive authentication

• Campcodes Bitcoin Wallet System
• Authentication bypass
• CWE-799

miroslavpejic85 MiroTalk P2P Room Action server.js checkPassword excessive authentication

• miroslavpejic85 MiroTalk P2P
• Authentication bypass
• CWE-799

Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks

• WSO2 API Manager
• WSO2 Identity Server
• CWE-799

Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg

• roostorg coop
• Authentication bypass
• CWE-799

NocoDB signup validatePassword excessive authentication

• NocoDB
• Authentication bypass
• CWE-799

YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication

• YunaiV ruoyi-vue-pro
• zhijiantianya ruoyi-vue-pro
• Authentication bypass
• CWE-799

baserCMS: Public Web API mail-form submission bypasses image CAPTCHA

• baserproject basercms
• CWE-693
• CWE-799

OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing

• openbao
• CWE-799

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171

• Drupal Webform
• CWE-799

OpenCATS Career Portal CareersUI.php processLogin excessive authentication

• OpenCATS
• Authentication bypass
• CWE-799

Jivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS Endpoint

• banq jivejdon
• CWE-799

PII Enumeration via Missing Rate Limiting in Pusula Communication's Expert Mail

• Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. Expert Mail
• CWE-799

WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability

• Arraytics WP Event Solution
• CWE-799

linlinjava litemall Login Endpoint AdminAuthController.java excessive authentication

• linlinjava litemall
• Authentication bypass
• CWE-799

ClawHub before 8c2de6c506 Skill Hiding via Coordinated Reports

• openclaw clawhub
• CWE-799

Zammad: Missing rate limiting allows password brute-forcing during two-factor login

• zammad
• Information disclosure
• Authentication bypass

Saleor throttling.py get_client_ip excessive authentication

• Saleor
• Authentication bypass
• CWE-799

TS4300 Tape Library addresses security vulnerability

• IBM TS4300
• CWE-799

Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.

• IBM Sterling Partner Engagement Manager Essentials Edition
• IBM Sterling Partner Engagement Manager Standard Edition
• CWE-799

OmniBlocks: Spamming in Discussions tab possible via disc.yml

• OmniBlocks monorepo
• CWE-799

phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter

• thorsten phpMyFAQ
• CWE-799

Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo

• lemmy
• CWE-799

karakeep-app karakeep Login Endpoint auth.ts authorize excessive authentication

• karakeep
• Authentication bypass
• CWE-799

VictoriaMetrics VMAuth Authentication Endpoint main.go requestHandler excessive authentication

• VictoriaMetrics
• Authentication bypass
• CWE-799

mangroup dtale Login Endpoint auth.py login excessive authentication

• mangroup dtale
• Authentication bypass
• CWE-799

opensourcepos Open Source Point of Sale Login Endpoint Filters.php index excessive authentication

• opensourcepos Open Source Point of Sale
• Authentication bypass
• CWE-799

HCLSoftware Aftermarket EPC: HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a…

• HCLSoftware Aftermarket EPC
• CWE-799

Wazuh: Rate Limit Bypass via /events Endpoint

• wazuh
• CWE-799

Missing Rate Limiting in Mia Technologies' Pizzy Library

• MIA Technology Inc. Pizzy Library
• CWE-799

unitedbyai droidclaw claim Endpoint pairing.ts excessive authentication

• unitedbyai droidclaw
• Authentication bypass
• CWE-799

CodeWise Tornet Scooter Mobile App TwoFactor excessive authentication

• CodeWise Tornet Scooter Mobile App
• Authentication bypass
• CWE-799

Improper Rate Limiting in MeWare Software's PDKS

• MeWare Software Development Inc. PDKS
• CWE-799

Duplicate Advisory: OpenClaw: Fake DeviceToken Bypasses Shared Auth Rate Limiting

• CWE-799

<2026.3.31 · fixed in 2026.3.31

Duplicate Advisory: OpenClaw: Pairing pending-request caps were enforced per channel instead of per account

• CWE-799

>=2026.2.26, <2026.3.31 · fixed in 2026.3.31

Duplicate Advisory: OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification

• CWE-799

<2026.3.31 · fixed in 2026.3.31

OpenClaw: Pairing pending-request caps were enforced per channel instead of per account

• CWE-799

>=2026.2.26, <2026.3.31 · fixed in 2026.3.31

OpenClaw: Fake DeviceToken Bypasses Shared Auth Rate Limiting

• Authentication bypass
• CWE-799

<2026.3.31 · fixed in 2026.3.31

OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification

• Denial of service
• CWE-799

<2026.3.31 · fixed in 2026.3.31

HCL Aftermarket DPC is affected by Spamming Vulnerability

• HCL Aftermarket DPC
• CWE-799

Runtipi has a TOTP two-factor authentication bypass via unrestricted brute-force on `/api/auth/verify-totp`

• runtipi
• Authentication bypass
• CWE-799

IBM Aspera Console Denial of Service

• IBM Aspera Console
• CWE-799

wpDiscuz before 7.6.47 - No Rate Limiting on Subscription Endpoints with LIKE Wildcard Bypass

• gVectors wpDiscuz
• CWE-799

Parse Server has a rate limit bypass via batch request endpoint

• CWE-799

<8.6.23 || >=9.0.0-alpha.1, <9.5.2-alpha.10 · fixed in 8.6.23, 9.5.2-alpha.10

Fortinet FortiWeb: An Improper Control of Interaction Frequency vulnerability [CWE-799] vulnerability in…

• Fortinet FortiWeb
• CWE-799

OpenClaw's hooks count non-POST requests toward auth lockout

• Authentication bypass
• CWE-799

<2026.3.7 · fixed in 2026.3.7

Tasin1025 SwiftBuy login.php excessive authentication

• Tasin1025 SwiftBuy
• Authentication bypass
• CWE-799

D-Link DIR-823X Login sub_40AC74 excessive authentication

• D-Link DIR-823X
• Authentication bypass
• CWE-799

Beetel 777VR1 UART excessive authentication

• Beetel 777VR1
• Authentication bypass
• CWE-799

IBM Aspera Orchestrator Denial of Service

• IBM Aspera Orchestrator
• CWE-799

In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the reset password function, leading to an email bombing vulnerability.

• CWE-799

LogicalDOC Community Edition Admin Login login.jsp excessive authentication

• LogicalDOC Community Edition
• Authentication bypass
• CWE-799

VirtFusion Email Change _settings excessive authentication

• VirtFusion
• Authentication bypass
• CWE-799

JhumanJ OpnForm HTTP Header excessive authentication

• JhumanJ OpnForm
• Authentication bypass
• CWE-799

Harness Login Endpoint login excessive authentication

• Harness
• Authentication bypass
• CWE-799

Fides Webserver API Rate Limiting Vulnerability in Proxied Environments

• Authentication bypass
• Denial of service

<2.69.1 · fixed in 2.69.1

mtons mblog password excessive authentication

• mtons mblog
• Authentication bypass
• CWE-799

mtons mblog Verification Code send_code excessive authentication

• mtons mblog
• Authentication bypass
• CWE-799

macrozheng mall Admin Login excessive authentication

• macrozheng mall
• Authentication bypass
• CWE-799

Mercusys MW301R Login excessive authentication

• Mercusys MW301R
• Authentication bypass
• CWE-799

Traceroute_APP responses are not rate-limited.

• meshtastic firmware
• CWE-799