Vulnerability Details
Severity:
Medium
Category:
auth
Description
The application does not implement rate limiting on sensitive endpoints, allowing unlimited requests that could facilitate brute force attacks or denial of service.
Risks
Attackers can perform unlimited login attempts, enumerate valid usernames, exhaust server resources, or abuse API endpoints without restriction.
Remediation
Implement rate limiting on authentication endpoints with exponential backoff. Add CAPTCHA after failed attempts. Consider implementing account lockout policies. Use API gateways with built-in rate limiting.