CVE-2020-11052

CVE-2020-11052 describes a critical brute force vulnerability in Sorcery versions prior to 0.15.0, specifically impacting its password authentication mechanism when the built-in brute force protection submodule is enabled. An attacker can bypass the lockout period by waiting for it to expire, then continue brute-forcing until a successful login, as protection is not re-enabled automatically. This vulnerability carries a CVSS score of 9.8 (CRITICAL), indicating it is network-exploitable with low attack complexity, potentially leading to full compromise of confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.