| Название | VictoriaMetrics <=1.146.0 Improper Restriction of Excessive Authentication Attempts |
|---|
| Описание | The VMAuth (<=1.146.0) authentication endpoint lacks a brute-force protection mechanism, has no limit on login failure attempts, no account locking, and no CAPTCHA. Attackers can attempt to guess the credentials without limit. This vulnerability was verified with python POC in the vulnerability report: https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11180 |
|---|
| Источник | ⚠️ https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11180 |
|---|
| Пользователь | ZAST.AI (UID 87884) |
|---|
| Представление | 26.06.2026 10:51 (2 месяцы назад) |
|---|
| Модерация | 14.08.2026 21:02 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 390088 [VictoriaMetrics до 1.146.0 VMAuth Authentication Endpoint app/vmauth/main.go requestHandler раскрытие информации] |
|---|
| Баллы | 19 |
|---|