CVE-2026-35098
KTM System e-BOK does not implement any limit or timeout on consecutive login attempts, allowing an attacker to perform unlimited authentica
CVSS
—
No CVSS
EPSS
0.3%
p24
KEV
—
Exploit Today
7
0-100
Published: Jun 30, 2026 · Last modified: Jun 30, 2026 · CWE-307
0.3%EPSS · 30 days0.3%
2026-07-012026-07-21
KTM System e-BOK does not implement any limit or timeout on consecutive login attempts, allowing an attacker to perform unlimited authentication requests. This lack of rate‑limiting enables efficient brute‑force attacks against user accounts. When combined with vulnerability CVE-2026-35097, where passwords are restricted to a six‑digit numeric format, this becomes a critical issue, as such passwords can be brute‑forced in a relatively short time. This issue was fixed in the patch published in June 2026.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-82854.3 MED—
——0Improper restriction of excessive authentication attempts vulnerability in Universal Software Inc. FlexCity allows Excessive Allocation.
This issue affects FlexCity: from 5.536.0 through 11052026.6hCVE-2026-328257.3 HIG21.6%
——6dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the browser login flow and the JSON login endpoint. The source code enables Devise's `:lockable` module on the user model but explicitly disables both lock and unlock strategies, and no request throttling or rate-limiting layer was identified in the Rails code. This creates a direct online password-guessing risk:
- valid user accounts can be attacked continuously without temporary lockout
- the same weakness is reachable through both `/users/sign_in` and `/api/v4/auth/login`
- successful guessing yields a normal session cookie in the HTML flow or a fresh JWT in the API flow
- the API endpoint is especially attractive for automation because it requires no CSRF token
This has been patched in version 26.06.08.4hCVE-2026-622205.3 MED23.4%
——7OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts. When the affected feature is enabled and reachable by lower-trust input, this can consume gateway resources and reduce service availability.3hCVE-2026-445966.5 MED75.7%
——23Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, account lockout, or failed-attempt throttling, so an unauthenticated remote attacker could perform unlimited password-guessing attempts against any user account, significantly increasing the risk of successful brute-force attacks. This issue is fixed in versions 5.12.7 and 5.13.0.4dCVE-2026-14254—25.2%
——8A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout threshold to be bypassed through concurrent authentication requests. Parallel login attempts were processed before the failed-login counter and lockout status were updated, defeating brute-force protections and enabling continued password guessing against a targeted account.5dCVE-2026-614587.5 HIG22.5%
——7PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a push token can systematically guess passphrases at 120 attempts per minute without triggering any push-level defense, making short or dictionary-derived passphrases practically recoverable within hours or days.6d