| 제목 | VictoriaMetrics <=1.146.0 Improper Restriction of Excessive Authentication Attempts |
|---|
| 설명 | The VMAuth (<=1.146.0) authentication endpoint lacks a brute-force protection mechanism, has no limit on login failure attempts, no account locking, and no CAPTCHA. Attackers can attempt to guess the credentials without limit. This vulnerability was verified with python POC in the vulnerability report: https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11180 |
|---|
| 원천 | ⚠️ https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11180 |
|---|
| 사용자 | ZAST.AI (UID 87884) |
|---|
| 제출 | 2026. 06. 26. AM 10:51 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 14. PM 09:02 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 390088 [VictoriaMetrics 까지 1.146.0 VMAuth Authentication Endpoint app/vmauth/main.go requestHandler 정보 공개] |
|---|
| 포인트들 | 19 |
|---|