Improper Restriction of Excessive Authentication Attempts in Wekan - #VU144221
Published: August 18, 2026
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper restriction of excessive authentication attempts in the wekan-accounts-lockout package, specifically the KnownUser.validateLoginAttempt method, when handling failed login attempts for a known username. A remote attacker can submit repeated incorrect passwords for a target account to cause a denial of service.
The lockout state is tracked in a single global counter per user rather than per source IP, allowing a known username to be locked out from every IP. During the lock window, even correct-password login attempts are rejected, and self-registration for the target is also blocked while the lock is active.