| शीर्षक | VictoriaMetrics <=1.146.0 Improper Restriction of Excessive Authentication Attempts |
|---|
| विवरण | The VMAuth (<=1.146.0) authentication endpoint lacks a brute-force protection mechanism, has no limit on login failure attempts, no account locking, and no CAPTCHA. Attackers can attempt to guess the credentials without limit. This vulnerability was verified with python POC in the vulnerability report: https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11180 |
|---|
| स्रोत | ⚠️ https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11180 |
|---|
| उपयोगकर्ता | ZAST.AI (UID 87884) |
|---|
| सबमिशन | 26/06/2026 10:51 AM (2 महीनों पहले) |
|---|
| संयम | 14/08/2026 09:02 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 390088 [VictoriaMetrics तक 1.146.0 VMAuth Authentication Endpoint app/vmauth/main.go requestHandler सूचना का प्रकटीकरण] |
|---|
| अंक | 19 |
|---|