CVE-2026-2402

CVE-2026-2402 is a CWE-307 vulnerability involving improper restriction of excessive authentication attempts that allows attackers to conduct brute force attacks against user accounts across multiple endpoints without rate limiting controls. The vulnerability enables an attacker to submit unlimited authentication attempts using different credentials across a sequence of requests, potentially compromising user accounts through credential enumeration and password guessing attacks. The vulnerability has a MEDIUM severity rating with a CVSS score of 5.3, featuring a network-based attack vector with low complexity and no authentication requirements. However, impact is limited to availability rather than confidentiality or integrity, suggesting the primary risk is account lockout or denial of service rather than data breach. Current exploitation status indicates minimal community attention and risk. The vulnerability is not listed in the Known Exploited Vulnerabilities catalog, remains inactive on threat intelligence hot lists, and demonstrates extremely low prevalence in the threat landscape with an EPSS score of 0.00058. No public exploit code or active exploitation campaigns have been identified at this time.