Improper Restriction of Excessive Authentication Attempts

CRITICO 9.8CVE-2022-2321 · GHSA-8r94-4h3c-939f · Published 05/07/2022 · updated 17/06/2026

In breve

CVE-2022-2321 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda github.com/heroiclabs/nakama/v3, nakama (heroiclabs).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.6%, superiore al 75.6% delle vulnerabilità.
Correzione: aggiornare a 3.13.0 o successiva.

Package	Affected versions	Patched versions
github.com/heroiclabs/nakama/v3 Go	`≤ 3.12.0`	No fix yet
nakama heroiclabs	`< 3.13.0`	`3.13.0`

Description

Nakama Console does not enforce any limit for the number of unsuccessful login attempts.

NVD description

Improper Restriction of Excessive Authentication Attempts in GitHub repository heroiclabs/nakama prior to 3.13.0. This results in login brute-force attacks.

References

nvd.nist.gov/vuln/detail/CVE-2022-2321 · ADVISORY
heroiclabs/nakama#878 · WEB
heroiclabs/nakama commit e2e02fc · WEB
heroiclabs/nakama · PACKAGE
huntr.dev/bounties/3055b3f5-6b80-4d47-8e00-3500dfb458bc · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free