CVE-2026-2402

MediumCVSS 5.3

Published: 14/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

20th percentile - higher than 20% of all known CVEs

Summary

A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to gain access to a user account by performing an arbitrary number of authentication attempts with different credentials across a sequence of requests to multiple endpoints.

Risk Assessment

Lack of login attempt restrictions enables brute-force attacks and account takeover, potentially leading to unauthorized system access.

Recommendation

Implement login attempt throttling (rate limiting, account lockout) along with strong password policies and multi-factor authentication.

Other vulnerabilities in Authentication

CVE-2026-77172Medium
App passwords were allowed to bypass password confirmation on sensitive endpoints. This enabled sensitive operations to be performed without re-authentication.

Original NVD description (English source)

CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to gain access to the user account by performing an arbitrary number of authentication attempts with different credentials on a sequence of requests to multiple endpoints.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS