Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Credentials from the request are verified in this handler with no throttling, lockout, or failed-attempt accounting. An unauthenticated attacker can guess passwords against this endpoint indefinitely (CWE-307), and if the credential check short-circuits password hashing for unknown usernames (e.g. `if not user or not check_password_hash(...)`) the same endpo
A one-time verification code or replacement password is generated with a non-cryptographic PRNG (mt_rand/rand/lcg_value/uniqid). Its output is predictable or drawn from a tiny value space (e.g. a 6-digit OTP or a 5-digit numeric password), so an attacker who can reach the verification endpoint can guess the credential and take over the account, especially wh
The one-time-password check '$METHOD' verifies an attacker-supplied code without any failed-attempt accounting or lockout in the same scope. An attacker who already knows the account password can keep the half-authenticated session and submit unlimited OTP guesses (CWE-307), defeating two-factor authentication and taking over the account. Record every failed
A rejected authentication code ($CODE_CHECK) is handled by logging and throwing $ERR without any state change: no attempt counter is incremented, no pending session/token is invalidated, and no rate limit or lockout is applied. An attacker who already knows the password can hold the pending (step-up) token for its whole lifetime and replay this endpoint, enu
HTTP Basic authentication ($AUTH) is applied to route group $G without a rate-limiting middleware in the same middleware chain. BasicAuth validates a username/password guess on every request, so without a per-client failure budget this endpoint allows unbounded online password guessing and bypasses the anti-brute-force controls that protect other login endpo
Device-code grant redemption (grant_type=urn:ietf:params:oauth:grant-type:device_code) validates the redeeming user only with UserModel.isEnabled() and never consults brute-force lockout state. Temporary lockout is tracked separately by BruteForceProtector/attack-detection state and does not clear the enabled flag, so an approved, non-expired, single-use dev
A client-supplied forwarding header (X-Forwarded-For, X-Real-IP, Client-IP, Forwarded) is trusted as the client IP whenever the direct peer address (REMOTE_ADDR) merely classifies as private/loopback/internal. Behind a reverse proxy, load balancer, NAT, container ingress or tunnel, REMOTE_ADDR is private for every request, including attacker requests, so thi
A brute-force throttle/lockout record is read, reset, or deleted with a conditionally applied tenant filter (`$COND ? eq($TABLE.$TENANTCOL, $COND) : undefined`) while the throttle row is keyed by the tenant-independent identifier alone. Because the row's tenant tag is written by whichever tenant first records a failed attempt, a lookup issued by any other te
The flag "$FLAG" decides whether the failed-login-attempt counter is preserved based only on MFA/TOTP state and never checks whether the authentication attempt succeeded. When a login or 2FA attempt fails, the counter is written back unchanged, so the account-lockout gate (maximum failed attempts) can never trigger and passwords or TOTP codes can be guessed
Rate limiting identity resolver only checks for the presence of the 'number' parameter and ignores 'couponCode'. Requests modifying session-based carts without the 'number' parameter bypass rate limiting, allowing coupon enumeration and brute-force attacks.
Failed login counter update and commit is performed without handling database operational or locking exceptions. Unhandled database errors can cause the transaction to fail before recording failed login attempts, enabling brute-force attacks to bypass lockout controls.
Passphrase or password verification failure returns an error response without recording the failed attempt or triggering rate-limiting/throttling. This allows unthrottled brute-force or credential stuffing attacks.
A Livewire form containing a password input uses the `wire:submit` directive without the `.prevent` modifier. In older versions of Livewire, this omission causes the browser to perform a native HTML GET submission by default. This causes sensitive credentials (like user passwords) to leak directly into the URL query string, where they can be cached in browse
The `/auth/token` endpoint lacks an explicit rate-limiting control. This omission allows unauthenticated attackers to perform unrestricted password-guessing attempts, leading to brute-force attacks or Denial-of-Service. Ensure that `checkRateLimit()` is invoked before parsing and processing the token request.
Call to securityStrategy.login() is not preceded by a login rate-limit check in the enclosing function. Authentication entry points must be throttled to prevent online brute-force / credential-stuffing attacks (CVE-2026-41893, CWE-307). The HTTP routes /login and /signalk/v1/auth/login are guarded by express-rate-limit, but WebSocket message handlers invokin
A verification-code verify-style function retrieves a stored OTP and immediately returns a constant-time equality comparison without incrementing an attempt counter or invalidating the code on repeated failures. With small code keyspaces (e.g. 6-digit OTPs) and a multi-minute TTL, this allows brute-force account takeover when the external rate limiter is abs
Login endpoint $FUNC accepts password credentials (OAuth2PasswordRequestForm) and verifies them with an authentication call, but no rate limit / failed-attempt control is enforced in the handler. An unauthenticated attacker can perform online password brute-force or password spraying at line speed and take over the account (CWE-307). Enforce an attempt limit
A missing rate-limit check before verifying an authentication code allows an attacker to brute-force the code. Ensure that rate limiting, such as `check_email_authentication_attempt`, is enforced and its error is handled before querying for the authentication code.
The "current password" submitted to a change-password handler is verified with a bare check_password() call that has no failed-attempt counting, lockout, or notification side effects. An attacker holding an authenticated session can brute-force the user's password by replaying this endpoint without ever being rate-limited or locked out. Validate the submitte
