Improper Restriction of Excessive Authentication Attempts

CRÍTICO 9.8CVE-2022-2321 · GHSA-8r94-4h3c-939f · Published 05/07/2022 · updated 17/06/2026

Em resumo

CVE-2022-2321 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta github.com/heroiclabs/nakama/v3, nakama (heroiclabs).
Chance de exploração nos próximos 30 dias (EPSS): 1.6%, maior que 75.7% das vulnerabilidades.
Correção: atualize para 3.13.0 ou posterior.

Package	Affected versions	Patched versions
github.com/heroiclabs/nakama/v3 Go	`≤ 3.12.0`	No fix yet
nakama heroiclabs	`< 3.13.0`	`3.13.0`

Description

Nakama Console does not enforce any limit for the number of unsuccessful login attempts.

NVD description

Improper Restriction of Excessive Authentication Attempts in GitHub repository heroiclabs/nakama prior to 3.13.0. This results in login brute-force attacks.

References

nvd.nist.gov/vuln/detail/CVE-2022-2321 · ADVISORY
heroiclabs/nakama#878 · WEB
heroiclabs/nakama commit e2e02fc · WEB
heroiclabs/nakama · PACKAGE
huntr.dev/bounties/3055b3f5-6b80-4d47-8e00-3500dfb458bc · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free