CVE-2026-97363

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-02

Last updated on: 2026-10-06

Assigner: ICS-CERT

Description

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-02

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-03

EPSS Evaluated

2026-10-18

NVD

CVE-2026-97363

EUVD

EUVD-2026-91822

Affected Vendors & Products

Vendor	Product	Version / Range
Monta	monta.app	All versions

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-307	The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

Executive Summary

The WebSocket API does not limit authentication requests, allowing attackers to send excessive requests. This can lead to denial-of-service attacks by overwhelming the system or brute-force attacks to guess credentials and gain unauthorized access.

Detection Guidance

To detect this vulnerability, monitor WebSocket authentication request rates for unusually high traffic. Use network tools like tcpdump or Wireshark to capture WebSocket traffic and analyze request patterns. Check server logs for repeated authentication attempts targeting the WebSocket API.

Impact Analysis

An attacker could disrupt service availability by flooding the API with requests, causing downtime. They might also exploit it to repeatedly guess passwords, potentially compromising user accounts and sensitive data.

Compliance Impact

This vulnerability could lead to unauthorized access, violating data protection requirements in GDPR and HIPAA. It may result in data breaches, non-compliance penalties, and loss of trust due to inadequate security controls.

Mitigation Strategies

Implement rate limiting on the WebSocket API to restrict authentication requests. Configure firewalls or API gateways to block excessive requests. Update server configurations to enforce strict authentication timeouts and retry limits.

Hi! I’m here to help you understand CVE-2026-97363. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70