WakaTime · Report #244909
Login page password - guessing attack
Informativestatus
lowseverity
6upvotes
1 Jul 2017disclosed
Summary
Brute forcing with no account lockout
How it was found
No account lock out after a certain number of failed login attempts
Steps to reproduce: navigate to https://wakatime.com/ and enter email address and false password
make more than attempts and account does not get locked out
After failed attempts, I was still able to login in with my password