CVE WatchNov 13, 2026

CVE-2026-105622

Improper restriction of excessive authentication attempts in the WAMP-CRA (challenge-response) authentication path in Zenitel Connect before

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Nov 13, 2026 · Last modified: Nov 13, 2026 · CWE-307

EPSS · 30d

Not enough EPSS history yet.

Technical description

Improper restriction of excessive authentication attempts in the WAMP-CRA (challenge-response) authentication path in Zenitel Connect before 1.11.0 allows remote attackers to guess user passwords via unlimited authentication attempts, because the path, in which the broker issues a challenge and the client returns an HMAC of it keyed with the user's secret, applies no account lockout or rate limiting. Affected releases enforce a password policy of at least 12 characters including upper-case, lower-case, numeric and special characters, so practical exploitation requires a reused or predictable password rather than exhaustive guessing. The WAMP-CRA authentication path is removed in 1.11.0.

Official references

www.zenitel.comhttps://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-918698.1 HIG

—

———IBM Security QRadar EDR 3.12 through 3.12.26 could allow a remote authenticated attacker to bypass security restrictions due to improper rate limiting on TOTP verification.3h CVE-2026-1291617.4 HIG

—

———Dromara free-fs 2.0.1 through 2.3.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute-force six-digit password reset codes via PUT /apis/user/forget-password. Attackers can request a code for a known email and submit unlimited guesses during its 300-second lifetime to set a chosen password and take over the account.3h CVE-2026-1283327.4 HIG

—

——0Listmonk 6.0.0 before 7.0.0-beta.2 contains a 2FA bypass vulnerability that allows attackers with a valid password to brute-force TOTP codes because the attempt counter resets on every new password login. Attackers can repeatedly submit credentials to POST /admin/login to obtain fresh tokens, each allowing 15 more guesses, gaining sessions for 2FA-protected accounts including Super Admin.7h CVE-2026-1270797.4 HIG

—

——0OpsTree BuildPiper before 2.7.0 lacks rate limiting on password-reset OTP verification, allowing unauthenticated attackers to brute force 6-digit OTPs. Attackers can initiate a reset and submit unthrottled guesses to the check_otp endpoint, resetting the target's password and taking over the account.10h CVE-2026-1269406.5 MED

—

——0Zipline before 4.6.4 contains a rate limit bypass vulnerability that allows remote attackers to evade request limits by varying query strings or supplying the x-zipline-p-filename header. Attackers can append differing query parameters to login and file or short-link password verification endpoints to perform credential guessing beyond the intended rate limits.15h CVE-2026-1264548.1 HIG

—

——0OpenEMR before 8.5.0 lacks rate limiting or lockout on TOTP submission, allowing attackers with a valid password to brute-force the 6-digit MFA code. Attackers can script repeated POST requests to main_screen.php or the OAuth2 authorization flow with re-submitted hidden credentials to bypass two-factor authentication.15h