CVE-2025-43863: Change Password Bruteforce No Rate Limitcve-2025-43863-change-password-bruteforce-no-rate-limit
The "current password" submitted to a change-password handler is verified with a bare check_password() call that has no failed-attempt counting, lockout, or notification side effects. An attacker holding an authenticated session can brute-force the user's password by replaying this endpoint without ever being rate-limited or locked out. Validate the submitte
