CVE-2026-97363

Summary

The WebSocket API lacks rate limiting on authentication requests, allowing attackers to perform denial-of-service attacks or brute-force credential guessing with unlimited attempts. This vulnerability exists due to insufficient input validation and control over authentication request frequency.

Exploitability

Exploitation is straightforward requiring only a WebSocket connection and ability to send repeated authentication messages, with no special preconditions needed beyond network access to the affected service.

Blast radius

An attacker could exhaust system resources through massive concurrent authentication attempts or successfully brute-force credentials across many accounts, potentially leading to unauthorized access to user sessions or complete service disruption.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Implement rate limiting on WebSocket authentication endpoints with a maximum of 10 requests per minute per IP address, and consider adding exponential backoff for failed attempts.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.