| 标题 | VictoriaMetrics <=1.146.0 Improper Restriction of Excessive Authentication Attempts |
|---|
| 描述 | The VMAuth (<=1.146.0) authentication endpoint lacks a brute-force protection mechanism, has no limit on login failure attempts, no account locking, and no CAPTCHA. Attackers can attempt to guess the credentials without limit. This vulnerability was verified with python POC in the vulnerability report: https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11180 |
|---|
| 来源 | ⚠️ https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11180 |
|---|
| 用户 | ZAST.AI (UID 87884) |
|---|
| 提交 | 2026-06-26 10時51分 (2 月前) |
|---|
| 管理 | 2026-08-14 21時02分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 390088 [VictoriaMetrics 直到 1.146.0 VMAuth Authentication Endpoint app/vmauth/main.go requestHandler 信息公开] |
|---|
| 积分 | 19 |
|---|