Ben Rogozinski

Name of the Vulnerable Software and Affected Versions: RapidIdentity LTS versions 2023.0.2 and earlier RapidIdentity Cloud versions 2024.08.0 and earlier Description: The issue allows a remote attacker to cause a denial of service via the `username` parameters by improperly restricting excessive authentication attempts. Recommendations: For RapidIdentity LTS versions 2023.0.2 and earlier, consider restricting access to authentication mechanisms to minimize the risk of exploitation. For RapidIdentity Cloud versions 2024.08.0 and earlier, consider implementing rate limiting on authentication attempts as a temporary workaround. At the moment, there is no information about a newer version that contains a fix for this vulnerability.