The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Primary

Architecture and Design
COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.

Access Control
Bypass Protection Mechanism
An attacker could perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to the targeted account using a brute force attack.

Dynamic Analysis with Automated Results Interpretation

According to SOAR [REF-1479], the following detection techniques may be useful:

Highly cost effective:

Web Application Scanner
Web Services Scanner
Database Scanners

Cost effective for partial coverage:

Host-based Vulnerability Scanners - Examine configuration for flaws, verifying that audit mechanisms work, ensure host configuration meets certain predefined criteria

High

Dynamic Analysis with Manual Results Interpretation

According to SOAR [REF-1479], the following detection techniques may be useful:

Highly cost effective:

Fuzz Tester
Framework-based Fuzzer

Cost effective for partial coverage:

Forced Path Execution

High

Manual Static Analysis - Source Code

According to SOAR [REF-1479], the following detection techniques may be useful:

Highly cost effective:

Focused Manual Spotcheck - Focused manual analysis of source
Manual Source Code Review (not inspections)

High

Automated Static Analysis - Source Code

According to SOAR [REF-1479], the following detection techniques may be useful:

Cost effective for partial coverage:

Source code Weakness Analyzer
Context-configured Source Code Weakness Analyzer

SOAR Partial

Automated Static Analysis

According to SOAR [REF-1479], the following detection techniques may be useful:

Cost effective for partial coverage:

Configuration Checker

SOAR Partial

Architecture or Design Review

According to SOAR [REF-1479], the following detection techniques may be useful:

Highly cost effective:

Formal Methods / Correct-By-Construction

Cost effective for partial coverage:

Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)

High

Architecture and Design

Common protection mechanisms include:

Disconnecting the user after a small number of failed attempts
Implementing a timeout
Locking out a targeted account
Requiring a computational task on the user's part.

Architecture and Design
Libraries or Frameworks

Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]

In January 2009, an attacker was able to gain administrator access to a Twitter server because the server did not restrict the number of login attempts [REF-236]. The attacker targeted a member of Twitter's support team and was able to successfully guess the member's password using a brute force attack by guessing a large number of common words. After gaining access as the member of the support staff, the attacker used the administrator panel to gain access to 33 accounts that belonged to celebrities and politicians. Ultimately, fake Twitter messages were sent that appeared to come from the compromised accounts.

The following code, extracted from a servlet's doPost() method, performs an authentication lookup every time the servlet is invoked.

String username = request.getParameter("username");String password = request.getParameter("password");
int authResult = authenticateUser(username, password);

However, the software makes no attempt to restrict excessive authentication attempts.

This code attempts to limit the number of login attempts by causing the process to sleep before completing the authentication.

$username = $_POST['username'];$password = $_POST['password'];sleep(2000);$isAuthenticated = authenticateUser($username, $password);

However, there is no limit on parallel connections, so this does not increase the amount of time an attacker needs to complete an attack.

In the following C/C++ example the validateUser method opens a socket connection, reads a username and password from the socket and attempts to authenticate the username and password.

int validateUser(char *host, int port){
int socket = openSocketConnection(host, port);if (socket < 0) {printf("Unable to open socket connection");return(FAIL);}
int isValidUser = 0;char username[USERNAME_SIZE];char password[PASSWORD_SIZE];
while (isValidUser == 0) {
if (getNextMessage(socket, username, USERNAME_SIZE) > 0) {if (getNextMessage(socket, password, PASSWORD_SIZE) > 0) {isValidUser = AuthenticateUser(username, password);}}
}return(SUCCESS);
}

The validateUser method will continuously check for a valid username and password without any restriction on the number of authentication attempts made. The method should limit the number of authentication attempts made to prevent brute force attacks as in the following example code.

int validateUser(char *host, int port){
...
int count = 0;while ((isValidUser == 0) && (count < MAX_ATTEMPTS)) {
if (getNextMessage(socket, username, USERNAME_SIZE) > 0) {if (getNextMessage(socket, password, PASSWORD_SIZE) > 0) {isValidUser = AuthenticateUser(username, password);}}count++;
}if (isValidUser) {return(SUCCESS);}else {return(FAIL);}
}

Consider this example from a
real-world attack against the iPhone
[REF-1218]. An attacker can use brute force
methods; each time there is a failed guess, the
attacker quickly cuts the power before the failed
entry is recorded, effectively bypassing the
intended limit on the number of failed
authentication attempts. Note that this attack
requires removal of the cell phone battery and
connecting directly to the phone's power source,
and the brute force attack is still
time-consuming.

CVE-2019-0039
the REST API for a network OS has a high limit for number of connections, allowing brute force password guessing
https://www.cve.org/CVERecord?id=CVE-2019-0039

CVE-1999-1152
Product does not disconnect or timeout after multiple failed logins.
https://www.cve.org/CVERecord?id=CVE-1999-1152

CVE-2001-1291
Product does not disconnect or timeout after multiple failed logins.
https://www.cve.org/CVERecord?id=CVE-2001-1291

CVE-2001-0395
Product does not disconnect or timeout after multiple failed logins.
https://www.cve.org/CVERecord?id=CVE-2001-0395

CVE-2001-1339
Product does not disconnect or timeout after multiple failed logins.
https://www.cve.org/CVERecord?id=CVE-2001-1339

CVE-2002-0628
Product does not disconnect or timeout after multiple failed logins.
https://www.cve.org/CVERecord?id=CVE-2002-0628

CVE-1999-1324
User accounts not disabled when they exceed a threshold; possibly a resultant problem.
https://www.cve.org/CVERecord?id=CVE-1999-1324

AUTHENT.MULTFAIL
Multiple Failed Authentication Attempts not Prevented

SFP34
Unrestricted authentication

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Sean Eidemiller
Cigital
2008-07-01
added/updated demonstrative examples

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2009-03-10
updated Relationships

CWE Content Team
MITRE
2009-07-27
updated Observed_Examples

CWE Content Team
MITRE
2009-12-28
updated Applicable_Platforms, Demonstrative_Examples, Potential_Mitigations

CWE Content Team
MITRE
2010-02-16
updated Demonstrative_Examples, Name, Potential_Mitigations, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2010-04-05
updated Demonstrative_Examples

CWE Content Team
MITRE
2011-03-29
updated Demonstrative_Examples

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences, Related_Attack_Patterns, Relationships

CWE Content Team
MITRE
2011-09-13
updated Potential_Mitigations, References, Relationships

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2014-07-30
updated Detection_Factors, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Demonstrative_Examples, Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2019-06-20
updated Demonstrative_Examples, Relationships

CWE Content Team
MITRE
2020-02-24
updated Detection_Factors, Relationships

CWE Content Team
MITRE
2020-08-20
updated Related_Attack_Patterns

CWE Content Team
MITRE
2021-10-28
updated Demonstrative_Examples, References, Relationships

CWE Content Team
MITRE
2022-10-13
updated Demonstrative_Examples, Description, Observed_Examples, References, Relationships

CWE Content Team
MITRE
2023-04-27
updated Demonstrative_Examples, References, Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-11-19
4.16
2024-11-19
updated Common_Consequences, Description, Diagram

CWE Content Team
MITRE
2025-09-09
4.18
2025-09-09
updated Demonstrative_Examples, Detection_Factors, Potential_Mitigations, References

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Relationships, Weakness_Ordinalities

Abhi Balakrishnan
2024-09-10
4.16
2024-11-19
Contributed usability diagram concepts used by the CWE team

Multiple Failed Authentication Attempts not Prevented
Failure to Restrict Excessive Authentication Attempts