Browse / Bypasses / Rate limits and lockouts

Getting past rate limits and lockouts

Throttling, attempt limits, lockouts and CAPTCHA. 81 disclosed reports got past one.

1. Hacker can bypass 2FA requirement and reporter blacklist through embedded submission formImproper Authorization · medium · HackerOne
   $10,000208 votes
2. Bypass password reset rate limit protection at moneybird.com/passwordsUncontrolled Resource Consumption · high · Moneybird
   164 votes
3. Rate limit bypass on passport.acronis.work using X-Forwarded-For request headerImproper Restriction of Authentication Attempts · medium · Acronis
   106 votes
4. PIN 📌 BYPASS 🥷Improper Authentication - Generic · high · Yoti
   84 votes
5. Bypass rate limiting on /users/password (possibly site-wide rate limit bypass?)Violation of Secure Design Principles · HackerOne
   76 votes
6. Weak Rate Limiting Controls in the (LOGIN) page Expose System to Brute Force and DoS AttacksImproper Restriction of Authentication Attempts · critical · Lichess
   74 votes
7. Authorization bypass using login by phone option+horizontal escalation possible on Grab Android AppImproper Authentication - Generic · high · Grab
   68 votes
8. Captcha bypass for the most important function - At en.instagram-brand.comImproper Restriction of Authentication Attempts · medium · Automattic
   65 votes
9. Bypass Password Authentication to Update the PasswordImproper Authentication - Generic · high · X / xAI
   59 votes
10. Bypassing Recaptcha Protection in `https://connect.acronis.com`Violation of Secure Design Principles · low · Acronis
    54 votes
11. Basic auth header on WebDAV requests is not bruteforce protectedImproper Restriction of Authentication Attempts · high · Nextcloud
    53 votes
12. No Rate Limiting On Phone Number Login Leads to Login BypassImproper Authentication - Generic · medium · Smule
    51 votes
13. Bypass CAPTCHA protectionImproper Authentication - Generic · medium · Rockstar Games
    51 votes
14. captcha bypass leads to register multiple user with one valid captchaBusiness Logic Errors · medium · Tennessee Valley Authority
    50 votes
15. Pre-authentication Stored XSS in Essity Customer-Service Pipeline via ContactApi (reCAPTCHA bypass + no rate limit)Cross-site Scripting (XSS) - Stored · critical · Essity
    48 votes
16. Two-factor authentication bypass on Grab Android AppImproper Authentication - Generic · medium · Grab
    46 votes
17. Throttling Bypass - ws1.dashlane.comImproper Restriction of Authentication Attempts · Dashlane
    43 votes
18. Email not verified when changing afterwards on apps.nextcloud.comViolation of Secure Design Principles · low · Nextcloud
    42 votes
19. Bypass Rate Limits on app.snapchat.com API Endpoint via X-Forwarded-For HeaderBusiness Logic Errors · medium · Snapchat
    40 votes
20. Bypass Password Authentication to Update the PasswordImproper Authentication - Generic · medium · X / xAI
    39 votes
21. Login page vulnerable to bruteforce attacks via rate limiting bypassImproper Restriction of Authentication Attempts · low · Khan Academy
    34 votes
22. No Rate Limit when accessing "Password protection" enabled surveys leads to bypassing passwords via "pd-pass_surveyid" cookieBusiness Logic Errors · low · Automattic
    33 votes
23. Bruteforce protection in password verification can be bypassedImproper Restriction of Authentication Attempts · medium · Nextcloud
    31 votes
24. Password of talk conversations can be bruteforcedImproper Restriction of Authentication Attempts · medium · Nextcloud
    27 votes
25. Rate-limit bypassImproper Authentication - Generic · Slack
    $50027 votes
26. Captcha checker "pd-captcha_form_SURVEYID" cookie is accepting any valueImproper Access Control - Generic · medium · Automattic
    26 votes
27. [www.drive2.ru] CSRF through FCTX token bypassCross-Site Request Forgery (CSRF) · medium · DRIVE.NET, Inc.
    26 votes
28. Expired reCAPTCHA site key leads to Rate Limit Bypass and Email EnumerationImproper Restriction of Authentication Attempts · Razer
    $20026 votes
29. bypass captcha in the form forgot passwordViolation of Secure Design Principles · low · Kartpay
    26 votes
30. Misconfigured rate limit at app.sign.plus/forgot_passwordBusiness Logic Errors · low · Alohi
    25 votes
31. Infinite Upvoting/Downvoting: Lockout Bypass, Plus: Exposed API DocumentationImproper Restriction of Authentication Attempts · Urban Dictionary
    25 votes
32. Missing brute force protection on password confirmation modalImproper Restriction of Authentication Attempts · medium · Nextcloud
    24 votes
33. Bypass GraphQL rate limit by abusing negative cost queriesBusiness Logic Errors · low · Shopify
    24 votes
34. HTTP Request Smuggling Vulnerability Analysis - cURL Security ReportHTTP Request Smuggling · medium · curl
    23 votes
35. Ratelimiting can be bypassed using IPv6 subnetsImproper Restriction of Authentication Attempts · low · Nextcloud
    23 votes
36. Captcha Bypass in Coinbase SignUp FormViolation of Secure Design Principles · low · Coinbase
    $10023 votes
37. Connection reuse ignores haproxyprotocol and HAPROXY_CLIENT_IP settings, allowing PROXY context to persist across transfersIncorrect Authorization · curl
    22 votes
38. Bypass of #1047119: Missing Rate Limit while creating Plug-Ins at https://my.stripo.email/cabinet/plugins/Business Logic Errors · medium · Stripo Inc
    19 votes
39. Bypass of Rate limiting in secure_session endpoint's password input will lead to user password disclosure Improper Restriction of Authentication Attempts · Moneybird
    19 votes
40. Rate Limit Bypass on login PageImproper Authentication - Generic · medium · Weblate
    18 votes
41. Missing brute force protection for passwords of password protected share linksImproper Restriction of Authentication Attempts · low · Nextcloud
    17 votes
42. Missing rate limiting on password reset functionality allows to send lot of emailsImproper Access Control - Generic · low · Nextcloud
    $10017 votes
43. CCC H1 June 2021 CTF WriteupXML External Entities (XXE) · critical · h1-ctf
    16 votes
44. Rate limit function bypass can leads to occur huge critical problem into website. Improper Access Control - Generic · medium · Courier
    16 votes
45. Bypassing Rate limit for forgot password by using different ip addressesViolation of Secure Design Principles · Zivver
    16 votes
46. 2 Bypass of #1067533 rate limit via X-Forwarded-For<space>: Source IP on ( www.trycourier.app )Uncontrolled Resource Consumption · medium · Courier
    15 votes
47. Issue in the implementation of captcha and race conditionViolation of Secure Design Principles · VK.com
    14 votes
48. No rate limiting for Remove Account lead to huge Mass mailingsBusiness Logic Errors · Weblate
    13 votes
49. Missing rate limit in current password change settings leads to Account takeoverImproper Restriction of Authentication Attempts · medium · Reddit
    13 votes
50. Improper Restriction of Excessive Authentication Attempts at http://terrafoot.ru/login.php (Rate Limit bypass via IP Rotation)Improper Restriction of Authentication Attempts · Mail.ru
    13 votes
51. Bypass verification of email while creating account(No rate limiting enable for verification code)Improper Authentication - Generic · MapLogin
    13 votes
52. Captcha protection Bypass on Forgot password pageViolation of Secure Design Principles · low · Kartpay
    12 votes
53. rubygems.org Batching attack to `confirmation_token` by bypass rate limitImproper Restriction of Authentication Attempts · low · Internet Bug Bounty
    $48011 votes
54. Captcha Bypass on SignUp FormPrivacy Violation · New Relic
    11 votes
55. [3] Bypassing IP Based Rate Limit Blocking leads to rate limit bypass in Courier Login PanelUncontrolled Resource Consumption · Courier
    10 votes
56. Improper Restriction of Excessive Authentication Attempts at https://top.mail.ru/edit? for site counter (Rate Limit bypass via IP Rotation)Improper Restriction of Authentication Attempts · Mail.ru
    10 votes
57. CRLF Injection in HAProxy PROXY Protocol via CURLOPT_HAPROXY_CLIENT_IP allows IP spoofing and protocol injectionCRLF Injection · medium · curl
    9 votes
58. Gopher Protocol Command Injection (SSRF Smuggling)Server-Side Request Forgery (SSRF) · high · curl
    9 votes
59. Improper Restriction of Excessive Authentication Attempts via https://certification.mail.ru/auth-form/?form=auth_certy (Rate limit Bypass)Improper Restriction of Authentication Attempts · Mail.ru
    9 votes
60. Captcha Bypass in Snapchat's Geofilter Submission ProcessViolation of Secure Design Principles · Snapchat
    9 votes
61. Authentication Bypass - Email Verification code bypass in account registration process.Improper Authentication - Generic · critical · UPchieve
    8 votes
62. Registration captcha bypassViolation of Secure Design Principles · medium · Weblate
    8 votes
63. Unauthenticated attacker can book appointments at arbitrary times, including outside availability and in the pastBusiness Logic Errors · low · Nextcloud
    7 votes
64. Rate limit Bypass on contact-us through IP Rotator (burp extension)(https://www.linkedin.com/help/linkedin/solve/contact)Improper Restriction of Authentication Attempts · LinkedIn
    7 votes
65. Rate Limit workaround in the message of the phone number verification Improper Restriction of Authentication Attempts · medium · Unikrn
    $1007 votes
66. Bypassing the SMS sending limit for download app link.Improper Restriction of Authentication Attempts · low · Eternal
    7 votes
67. Rate-limit protection get executed in the last stage of the registration process, allowing enumeration of existing account.Violation of Secure Design Principles · low · Unikrn
    7 votes
68. Captcha Bypass at Email Reset can lead to Spamming users.Violation of Secure Design Principles · Weblate
    7 votes
69. Bypass Too Many Requests Sign Up Authentication Bypass Using an Alternate Path or Channel · medium · Courier
    6 votes
70. No rate-limit in Two factor Authentication leads to bypass using bruteforce attackImproper Authentication - Generic · Algolia
    $1006 votes
71. Captcha Bypass enable login bruteforceImproper Authentication - Generic · Veris
    5 votes
72. Time-limit Bypassing, Rate-limit Bypassing and Spamming at https://ops.cuvva.coViolation of Secure Design Principles · Cuvva
    4 votes
73. Bypassing captcha in registration on Hosted siteUncontrolled Resource Consumption · medium · Weblate
    4 votes
74. Missing Rate limiting for sensitive actions (like "forgot password") and reCaptcha error. Violation of Secure Design Principles · bitaccess
    4 votes
75. Captcha Bypass With ExtensionCryptographic Issues - Generic · RelateIQ
    4 votes
76. Dos https://iandunn.name/ via CVE-2018-6389 exploitationUncontrolled Resource Consumption · Ian Dunn
    3 votes
77. Captcha bypass at registrationImproper Restriction of Authentication Attempts · low · Weblate
    3 votes
78. Denial of service in account statistics endpointUncontrolled Resource Consumption · Mapbox
    3 votes
79. Yahoo mail login page bruteforce protection bypassImproper Authentication - Generic · Yahoo!
    3 votes
80. Possibility of DoS attack at https://sifchain.finance// via CVE-2018-6389 exploitationUncontrolled Resource Consumption · Sifchain
    1 votes
81. Captcha bypass with extension at http://www.mopub.com/about/contact/Cryptographic Issues - Generic · X / xAI
    1 votes