CWE-645

Overly Restrictive Account Lockout Mechanism

BaseIncompleteLikelihood: High

Description

The product contains an account lockout protection mechanism, but the mechanism is too restrictive and can be triggered too easily, which allows attackers to deny service to legitimate users by causing their accounts to be locked out.

Account lockout is a security feature often present in applications as a countermeasure to the brute force attack on the password based authentication mechanism of the system. After a certain number of failed login attempts, the users' account may be disabled for a certain period of time or until it is unlocked by an administrator. Other security events may also possibly trigger account lockout. However, an attacker may use this very security feature to deny service to legitimate system users. It is therefore important to ensure that the account lockout security mechanism is not overly restrictive.

Hierarchy (View 1000)

Parents

CWE-287

Children

none

Related attack patterns (CAPEC)

CAPEC-2

CVEs mapped to this weakness (3)

CVE	Vendor / Product	Sev	Risk	CVSS	Published	Description
CVE-2026-53982	Cap Go Capgo	Med	0.35	6.5	Jun 12, 2026	Cap-go Console < 12.28.2 contains a denial-of-service vulnerability in its account deletion flow that allows an attacker to block authentication and onboarding functions by triggering account deletion while a device identifier is linked to the active session. The platform…
CVE-2025-5241	Mitsubishielectric MELSEC iQ-R Series	Med	0.34	5.3	Jul 11, 2025	Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series allows a remote unauthenticated attacker to lockout legitimate users for a certain period by repeatedly attempting to login with incorrect passwords. The legitimate…
CVE-2025-31947	Mattermost Mattermost		0.00	—	May 15, 2025	Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost.

CVE-2026-53982MedJun 12, 2026
Cap Go
Capgo
risk 0.35cvss 6.5epss 0.00
Cap-go Console < 12.28.2 contains a denial-of-service vulnerability in its account deletion flow that allows an attacker to block authentication and onboarding functions by triggering account deletion while a device identifier is linked to the active session. The platform…
CVE-2025-5241MedJul 11, 2025
Mitsubishielectric
MELSEC iQ-R Series
risk 0.34cvss 5.3epss 0.00
Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series allows a remote unauthenticated attacker to lockout legitimate users for a certain period by repeatedly attempting to login with incorrect passwords. The legitimate…
CVE-2025-31947May 15, 2025
Mattermost
Mattermost
risk 0.00cvss —epss 0.00
Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost.