critical9.8
CVE-2022-2321
Improper Restriction of Excessive Authentication Attempts
Impact
Nakama Console does not enforce any limit for the number of unsuccessful login attempts.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/heroiclabs/nakama/v3 | <= 3.12.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Heroiclabs | Nakama | before 3.13.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/heroiclabs/nakama/commit/e2e02fce80ff33ce45f8a6ebc0b7a99ee0b03824
- https://huntr.dev/bounties/3055b3f5-6b80-4d47-8e00-3500dfb458bc
- https://github.com/advisories/GHSA-8r94-4h3c-939f
- https://nvd.nist.gov/vuln/detail/CVE-2022-2321
- https://github.com/heroiclabs/nakama/pull/878