| عنوان | VictoriaMetrics <=1.146.0 Improper Restriction of Excessive Authentication Attempts |
|---|
| الوصف | The VMAuth (<=1.146.0) authentication endpoint lacks a brute-force protection mechanism, has no limit on login failure attempts, no account locking, and no CAPTCHA. Attackers can attempt to guess the credentials without limit. This vulnerability was verified with python POC in the vulnerability report: https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11180 |
|---|
| المصدر | ⚠️ https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11180 |
|---|
| المستخدم | ZAST.AI (UID 87884) |
|---|
| ارسال | 26/06/2026 10:51 AM (2 أشهر منذ) |
|---|
| الاعتدال | 14/08/2026 09:02 PM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 390088 [VictoriaMetrics حتى 1.146.0 VMAuth Authentication Endpoint app/vmauth/main.go requestHandler الكشف عن المعلومات] |
|---|
| النقاط | 19 |
|---|