Improper Restriction of Excessive Authentication Attempts

CRÍTICO 9.8CVE-2022-2321 · GHSA-8r94-4h3c-939f · Published 05/07/2022 · updated 17/06/2026

En resumen

CVE-2022-2321 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a github.com/heroiclabs/nakama/v3, nakama (heroiclabs).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.6%, mayor que el 75.7% de las vulnerabilidades.
Solución: actualizar a 3.13.0 o posterior.

Package	Affected versions	Patched versions
github.com/heroiclabs/nakama/v3 Go	`≤ 3.12.0`	No fix yet
nakama heroiclabs	`< 3.13.0`	`3.13.0`

Description

Nakama Console does not enforce any limit for the number of unsuccessful login attempts.

NVD description

Improper Restriction of Excessive Authentication Attempts in GitHub repository heroiclabs/nakama prior to 3.13.0. This results in login brute-force attacks.

References

nvd.nist.gov/vuln/detail/CVE-2022-2321 · ADVISORY
heroiclabs/nakama#878 · WEB
heroiclabs/nakama commit e2e02fc · WEB
heroiclabs/nakama · PACKAGE
huntr.dev/bounties/3055b3f5-6b80-4d47-8e00-3500dfb458bc · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free