CWE-645
AllowedOverly Restrictive Account Lockout Mechanism
Abstraction: Base · Status: Incomplete
The product contains an account lockout protection mechanism, but the mechanism is too restrictive and can be triggered too easily, which allows attackers to deny service to legitimate users by causing their accounts to be locked out.
17 vulnerabilities reference this CWE, most recent first.
GHSA-7W8Q-8495-MWHJ
Vulnerability from github – Published: 2025-07-11 03:30 – Updated: 2025-07-11 03:30Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series allows a remote unauthenticated attacker to lockout legitimate users for a certain period by repeatedly attempting to login with incorrect passwords. The legitimate users will be unable to login until a certain period has passed after the lockout or until the product is reset.
{
"affected": [],
"aliases": [
"CVE-2025-5241"
],
"database_specific": {
"cwe_ids": [
"CWE-645"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-11T01:15:29Z",
"severity": "MODERATE"
},
"details": "Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series allows a remote unauthenticated attacker to lockout legitimate users for a certain period by repeatedly attempting to login with incorrect passwords. The legitimate users will be unable to login until a certain period has passed after the lockout or until the product is reset.",
"id": "GHSA-7w8q-8495-mwhj",
"modified": "2025-07-11T03:30:34Z",
"published": "2025-07-11T03:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5241"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-184-04"
},
{
"type": "WEB",
"url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-005_en.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-9PMG-927M-MM79
Vulnerability from github – Published: 2024-08-14 15:31 – Updated: 2024-08-20 21:30BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
{
"affected": [],
"aliases": [
"CVE-2024-37028"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-645"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-14T15:15:21Z",
"severity": "MODERATE"
},
"details": "BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in.\u00a0 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
"id": "GHSA-9pmg-927m-mm79",
"modified": "2024-08-20T21:30:31Z",
"published": "2024-08-14T15:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37028"
},
{
"type": "WEB",
"url": "https://my.f5.com/manage/s/article/K000139938"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-QCCG-QQVH-PQ7Q
Vulnerability from github – Published: 2023-08-29 21:30 – Updated: 2026-07-15 18:31KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX installation, purge all devices without additional security options enabled, and set a BCU key, locking the device. Even if a device is not connected to a network, an attacker with physical access to the device could also exploit this vulnerability in the same way.
{
"affected": [],
"aliases": [
"CVE-2023-4346"
],
"database_specific": {
"cwe_ids": [
"CWE-645"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-29T20:15:10Z",
"severity": "HIGH"
},
"details": "KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX installation, purge all devices without additional security options enabled, and set a BCU key, locking the device. Even if a device is not connected to a network, an attacker with physical access to the device could also exploit this vulnerability in the same way.",
"id": "GHSA-qccg-qqvh-pq7q",
"modified": "2026-07-15T18:31:44Z",
"published": "2023-08-29T21:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4346"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4346"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QGWX-RFFP-6CX9
Vulnerability from github – Published: 2025-05-15 12:30 – Updated: 2025-05-17 14:01Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 10.6.1"
},
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "10.6.0"
},
{
"fixed": "10.6.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 10.5.2"
},
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "10.5.0"
},
{
"fixed": "10.5.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 10.4.4"
},
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "10.4.0"
},
{
"fixed": "10.4.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 9.11.11"
},
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "9.11.0"
},
{
"fixed": "9.11.12"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.0-20250415054241-76ab3867b785"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-31947"
],
"database_specific": {
"cwe_ids": [
"CWE-645"
],
"github_reviewed": true,
"github_reviewed_at": "2025-05-17T14:01:54Z",
"nvd_published_at": "2025-05-15T11:15:48Z",
"severity": "MODERATE"
},
"details": "Mattermost versions 10.6.x \u003c= 10.6.1, 10.5.x \u003c= 10.5.2, 10.4.x \u003c= 10.4.4, 9.11.x \u003c= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost.",
"id": "GHSA-qgwx-rffp-6cx9",
"modified": "2025-05-17T14:01:55Z",
"published": "2025-05-15T12:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31947"
},
{
"type": "WEB",
"url": "https://github.com/mattermost/mattermost/pull/30821"
},
{
"type": "PACKAGE",
"url": "https://github.com/mattermost/mattermost"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "Mattermost Fails to Lockout LDAP Users After Repeated Login Failures"
}
GHSA-V5GF-VPJC-PC7W
Vulnerability from github – Published: 2026-10-07 20:29 – Updated: 2026-10-07 20:29Impact
An unauthenticated attacker who knows an account’s email address or username could trigger Payload’s account lockout mechanism and prevent that user from signing in.
You are affected if:
- Using an affected Payload version with an auth-enabled collection that uses local authentication and account lockout.
Applications that do not use Payload local authentication are not affected.
Patches
Successful password resets now clear the account’s lockout state. The forgot-password flow also enforces a configurable minimum interval between reset emails, which defaults to 15 seconds.
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "payload"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.90.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "payload"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0-canary.0"
},
{
"fixed": "4.0.0-canary.34"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-105866"
],
"database_specific": {
"cwe_ids": [
"CWE-307",
"CWE-645"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-07T20:29:04Z",
"nvd_published_at": "2026-10-06T17:17:22Z",
"severity": "MODERATE"
},
"details": "### **Impact**\n\nAn unauthenticated attacker who knows an account\u2019s email address or username could trigger Payload\u2019s account lockout mechanism and prevent that user from signing in.\n\nYou are affected if:\n\n* Using an affected Payload version with an auth-enabled collection that uses local authentication and account lockout.\n\nApplications that do not use Payload local authentication are not affected.\n\n### **Patches**\n\nSuccessful password resets now clear the account\u2019s lockout state. The forgot-password flow also enforces a configurable minimum interval between reset emails, which defaults to 15 seconds.\n\nUsers should upgrade Payload packages to `\u003e= 3.90.0` or `\u003e= 4.0.0-canary.34`.",
"id": "GHSA-v5gf-vpjc-pc7w",
"modified": "2026-10-07T20:29:04Z",
"published": "2026-10-07T20:29:04Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/payloadcms/payload/security/advisories/GHSA-v5gf-vpjc-pc7w"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105866"
},
{
"type": "WEB",
"url": "https://github.com/payloadcms/payload/commit/1c46204a73a0a9f988a80c52690eee5a4ada3cf1"
},
{
"type": "PACKAGE",
"url": "https://github.com/payloadcms/payload"
},
{
"type": "WEB",
"url": "https://github.com/payloadcms/payload/releases/tag/v3.90.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Payload: Unauthenticated account-lockout denial of service"
}
GHSA-VF76-2HRM-W58J
Vulnerability from github – Published: 2026-03-04 15:30 – Updated: 2026-03-04 15:30Dell PowerScale OneFS, version 9.13.0.0, contains an overly restrictive account lockout mechanism vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.
{
"affected": [],
"aliases": [
"CVE-2026-25907"
],
"database_specific": {
"cwe_ids": [
"CWE-645"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-04T13:15:58Z",
"severity": "MODERATE"
},
"details": "Dell PowerScale OneFS, version 9.13.0.0, contains an overly restrictive account lockout mechanism vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.",
"id": "GHSA-vf76-2hrm-w58j",
"modified": "2026-03-04T15:30:35Z",
"published": "2026-03-04T15:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25907"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-sg/000434591/dsa-2026-095-security-update-for-dell-powerscale-onefs-overly-restrictive-account-lockout-mechanism-vulnerability"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-XV7G-4HGG-VMR5
Vulnerability from github – Published: 2026-10-14 15:32 – Updated: 2026-10-14 15:32Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Overly Restrictive Account Lockout Mechanism vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
{
"affected": [],
"aliases": [
"CVE-2026-35161"
],
"database_specific": {
"cwe_ids": [
"CWE-645"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-14T14:17:44Z",
"severity": "MODERATE"
},
"details": "Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Overly Restrictive Account Lockout Mechanism vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.",
"id": "GHSA-xv7g-4hgg-vmr5",
"modified": "2026-10-14T15:32:18Z",
"published": "2026-10-14T15:32:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35161"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000518964/dsa-2026-439-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation
Implement more intelligent password throttling mechanisms such as those which take IP address into account, in addition to the login name.
Mitigation
Implement a lockout timeout that grows as the number of incorrect login attempts goes up, eventually resulting in a complete lockout.
Mitigation
Consider alternatives to account lockout that would still be effective against password brute force attacks, such as presenting the user machine with a puzzle to solve (makes it do some computation).
CAPEC-2: Inducing Account Lockout
An attacker leverages the security functionality of the system aimed at thwarting potential attacks to launch a denial of service attack against a legitimate system user. Many systems, for instance, implement a password throttling mechanism that locks an account after a certain number of incorrect log in attempts. An attacker can leverage this throttling mechanism to lock a legitimate user out of their own account. The weakness that is being leveraged by an attacker is the very security feature that has been put in place to counteract attacks.