CVE-2026-56450

AIL did not restrict repeated failed attempts to verify a two-factor authentication (OTP) code. An attacker who had reached the 2FA verification step, such as after successfully completing the password-authentication stage, could submit an unlimited number of OTP guesses. This could enable brute-force guessing of a valid code and bypass the intended second authentication factor, resulting in unauthorized account access. The patch introduces per-user failed-OTP tracking, blocks verification after 30 failed attempts for one hour, clears the counter after a successful OTP verification, and provides administrator recovery actions to purge affected lockouts.

CVSS

No CVSS.

References

Link	Resource
https://github.com/ail-project/ail-framework/commit/d3a394fe68fd5aeee86f3a3c91d4a0350f91e974

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) AIL no restringía los intentos fallidos repetidos para verificar un código de autenticación de dos factores (OTP). Un atacante que había alcanzado el paso de verificación 2FA, como después de completar exitosamente la etapa de autenticación de contraseña, podía enviar un número ilimitado de intentos de OTP. Esto podría permitir el adivinado por fuerza bruta de un código válido y eludir el segundo factor de autenticación previsto, lo que resultaría en acceso no autorizado a la cuenta. El parche introduce el seguimiento de OTP fallidos por usuario, bloquea la verificación después de 30 intentos fallidos durante una hora, borra el contador después de una verificación OTP exitosa y proporciona acciones de recuperación del administrador para purgar los bloqueos afectados.

Information

Published : 2026-06-22 14:17

Updated : 2026-10-25 23:10

NVD link : CVE-2026-56450

Mitre link : CVE-2026-56450

CVE.ORG link : CVE-2026-56450

JSON object : View

Products Affected

No product.

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2026-56450", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56450", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T15:48:34.062796Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "affectedData": [{"repo": "https://github.com/ail-project/ail-framework", "vendor": "ail project", "product": "ail framework", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.8.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-22T14:17:50.760", "references": [{"url": "https://github.com/ail-project/ail-framework/commit/d3a394fe68fd5aeee86f3a3c91d4a0350f91e974", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "description": [{"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "AIL did not restrict repeated failed attempts to verify a two-factor authentication (OTP) code. An attacker who had reached the 2FA verification step, such as after successfully completing the password-authentication stage, could submit an unlimited number of OTP guesses. This could enable brute-force guessing of a valid code and bypass the intended second authentication factor, resulting in unauthorized account access.\n\n\nThe patch introduces per-user failed-OTP tracking, blocks verification after 30 failed attempts for one hour, clears the counter after a successful OTP verification, and provides administrator recovery actions to purge affected lockouts."}, {"lang": "es", "value": "AIL no restring\u00eda los intentos fallidos repetidos para verificar un c\u00f3digo de autenticaci\u00f3n de dos factores (OTP). Un atacante que hab\u00eda alcanzado el paso de verificaci\u00f3n 2FA, como despu\u00e9s de completar exitosamente la etapa de autenticaci\u00f3n de contrase\u00f1a, pod\u00eda enviar un n\u00famero ilimitado de intentos de OTP. Esto podr\u00eda permitir el adivinado por fuerza bruta de un c\u00f3digo v\u00e1lido y eludir el segundo factor de autenticaci\u00f3n previsto, lo que resultar\u00eda en acceso no autorizado a la cuenta.\n\nEl parche introduce el seguimiento de OTP fallidos por usuario, bloquea la verificaci\u00f3n despu\u00e9s de 30 intentos fallidos durante una hora, borra el contador despu\u00e9s de una verificaci\u00f3n OTP exitosa y proporciona acciones de recuperaci\u00f3n del administrador para purgar los bloqueos afectados."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}