GrepRules
Sign inPublish rule
Explore

Rule Explorer

Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.

Public rules
6965
Downloads
12.9M
Verified
6965
Authors
2
Search the rule indexUse CVE, GHSA, CWE, language, framework, package, or rule slug.
1 rules matched. Showing 1 loaded rules.
Publish rule
CVE-2026-19297: Python Fastapi Login Endpoint Missing Attempt Rate Limitcve-2026-19297-python-fastapi-login-endpoint-missing-attempt-rate-limit

Login endpoint $FUNC accepts password credentials (OAuth2PasswordRequestForm) and verifies them with an authentication call, but no rate limit / failed-attempt control is enforced in the handler. An unauthenticated attacker can perform online password brute-force or password spraying at line speed and take over the account (CWE-307). Enforce an attempt limit

PythonFastAPICVE-2026-19297CWE-307
by Provallyupdated 2026-10-27Apache-2.0
560 direct56 via packs
80
All matching rules loaded.