D-Link-CVE-2021-27342-exploit

D-Link-CVE-2021-27342-exploit Exploit for CVE-2021-27342 vulnerability telnet authentication brute-force protection bypass...

CVE-2019-17240_Bludit-BF-Bypass

CVE-2019-17240 Exploit/PoC - Bludit Brute-force Mitigation Bypass Exploit Code for CVE-2019-17240 aka Bludit = 3.9.2 Bruteforce Mitigation Bypass Exploit Links: ExploitDB-48942 PacketStorm Expected outcome: Discover login credentials, bypassing Brute-force Mechanism on host running Bludit =3.9.2...

CVE-2023-27100

CVE-2023-27100 - pfSense Anti-brute force protection bypass Problem Description The authentication system attempts to be informative and print extra information along with IP addresses to completely identify where a user logs in from when they login using the GUI. This includes the authentication...

CVE-2025-66204

CVE-2025-66204: WBCE CMS allows brute-force protection bypass using X-Forwarded-For header Overview...

CVE-2019-17240-Bludit-3.9.2-Auth-Bruteforce-Bypass

CVE-2019-17240 Bludit 3.9.2 auth bruteforce bypass...

CVE-2019-17240

CVE-2019-17240 Exploit Versions prior to and including 3.9.2 of the Bludit CMS are vulnerable to a bypass of the anti-brute force mechanism that is in place to block users that have attempted to incorrectly login 10 times or more. The vulnerability was discovered by Rastating. Submitting a login...

CVE-2026-43914-PoC

CVE-2026-43914 — Vaultwarden Email-2FA Brute-Force Protection Bypass Proof-of-concept for CVE-2026-43914 : when Email 2FA is enabled, Vaultwarden's login brute-force protection can be completely bypassed via the unauthenticated POST /api/two-factor/send-email-login endpoint, which acts as an...

CVE-2026-94379

CVE-2026-94379 affects MISP (versions

EUVD-2026-81283

AVideo through 29.0 contains a race condition in the enforceRateLimit function that fails to atomically increment rate limit counters, allowing attackers to bypass all rate limits including login brute-force protection by issuing concurrent requests. Attackers can submit parallel credential...

CVE-2026-82644 WWBN AVideo Brute-force Rate Limiting Bypass via Missing User-Agent

WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...

CVE-2026-78655 Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session

Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session. The POST handler on challengepath keeps the failure count as tries inside the totppending record in...

BIT-KEYCLOAK-2024-4629 Keycloak: potential bypass of brute force protection

A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. Thi...

CVE-2026-56710 Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock

Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the...

PT-2026-81990

A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. Thi...

Exploit for Improper Restriction of Excessive Authentication Attempts in Dani-Garcia Vaultwarden

CVE-2026-43914 — Vaultwarden Email-2FA Brute-Force Protection...

CVE-2026-69183 Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.6.5 Images Security Update

New images are available for Red Hat build of Keycloak 26.6.5 and Red Hat build of Keycloak 26.6.5 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat...

keycloak: Keycloak: Brute-force protection bypass in CIBA flow

A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily locked due to repeated failed login attempts, an attacker with valid client credentials can exploit the Client-Initiated Backchannel Authentication CIBA flow to bypass this...

CVE-2026-11870

The WP Ghost Hide My WP Ghost WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy before trusting attacker-controllable HTTP headers, allowing unauthenticated attackers to spoof their IP address to bypass the WP Ghost Hide My WP Ghost WordPress...

CVE-2026-63770

The CVE concerns Glance 0.8.5, where the authentication handler is vulnerable to IP address spoofing via the X-Forwarded-For header when the server proxied option is enabled. Attackers can alter the leftmost IP in the header to skew per-IP login counters, bypassing brute-force lockout protections...