CVE-2025-10761
BaseFortify
Publication date: 2025-09-21
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| harness | harness | 3.3.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-307 | The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame. |
| CWE-799 | The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Login Endpoint of Harness version 3.3.0, specifically in the /api/v1/login file. It allows an attacker to bypass proper restrictions on excessive authentication attempts, meaning the system does not adequately limit the number of login tries. This can be exploited remotely, although the attack is considered to have high complexity and is difficult to execute. The vulnerability has been publicly disclosed and may be exploited.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to perform excessive authentication attempts remotely, potentially leading to brute force or credential stuffing attacks. While the impact on confidentiality is partial, there is no direct impact on integrity or availability. However, successful exploitation could lead to unauthorized access or account compromise, depending on the context.