Unlimited Login Attempts: When Authentication Lacks Abuse Controls
Analysis of an authentication flow that processes consecutive failed login attempts without rate limiting, account lockout, or progressive backoff delays.
TAG ARCHIVE
#defense-in-depth
2 posts across research, tutorials, and notes.
Session Tokens and Password Changes: A Reauthentication Gap in Filebrowser Quantum
Analysis of a password change flow that accepts a valid session token without requiring current-password reauthentication.