Summary
Payload CMS contains an account lockout weakness in local-authentication collections that can prevent a targeted account from signing in. An unauthenticated attacker who knows the account's email address or username may trigger the lockout behavior without needing valid credentials.
Payload CMS contains an account lockout weakness in local-authentication collections that can prevent a targeted account from signing in. An unauthenticated attacker who knows the account's email address or username may trigger the lockout behavior without needing valid credentials.
Affected context
The issue occurs in Payload CMS deployments using local authentication collections with account lockout protections enabled or otherwise reachable through the authentication flow. It is relevant when an attacker can identify a target account's email address or username and repeatedly interact with the sign-in mechanism.
The issue occurs in Payload CMS deployments using local authentication collections with account lockout protections enabled or otherwise reachable through the authentication flow. It is relevant when an attacker can identify a target account's email address or username and repeatedly interact with the sign-in mechanism.
Exploit preconditions
- Attack surface: Local authentication sign-in endpoint
- Required access: No authentication; knowledge of a target account email address or username
- Trigger point: Authentication attempts that activate the account lockout mechanism
- Why exploitation is possible: The lockout control can be abused without first proving ownership of the account, allowing an unauthenticated party to affect the target's sign-in availability
- Attack surface: Local authentication sign-in endpoint
- Required access: No authentication; knowledge of a target account email address or username
- Trigger point: Authentication attempts that activate the account lockout mechanism
- Why exploitation is possible: The lockout control can be abused without first proving ownership of the account, allowing an unauthenticated party to affect the target's sign-in availability
Why this happens
The underlying flaw is an account lockout design that permits unauthenticated requests tied to a known account identifier to consume or activate the account's login-failure threshold. This maps to CWE-307: Improper Restriction of Excessive Authentication Attempts and is also related to CWE-645: Overly Restrictive Account Lockout Mechanism, because the defensive control can be turned into a denial-of-service condition against legitimate users.
The underlying flaw is an account lockout design that permits unauthenticated requests tied to a known account identifier to consume or activate the account's login-failure threshold. This maps to CWE-307: Improper Restriction of Excessive Authentication Attempts and is also related to CWE-645: Overly Restrictive Account Lockout Mechanism, because the defensive control can be turned into a denial-of-service condition against legitimate users.
Potential impact
- A targeted user may be unable to sign in
- Administrative or operational access may be disrupted
- Help-desk and account-recovery workload could increase
- Repeated targeting may cause broader authentication availability issues
- A targeted user may be unable to sign in
- Administrative or operational access may be disrupted
- Help-desk and account-recovery workload could increase
- Repeated targeting may cause broader authentication availability issues
General mitigation guidance
Mitigation generally focuses on making lockout controls resistant to unauthenticated abuse while preserving protection against password guessing.
Common defensive patterns include:
- Prefer graduated throttling, exponential backoff, or risk-based challenges over permanent or easily triggered lockouts
- Avoid exposing whether a submitted identifier corresponds to an existing account
- Apply controls across account, source, device, and session dimensions rather than relying on a single account-level threshold
- Provide secure, rate-limited recovery paths that do not reveal account status
- Monitor and limit repeated authentication activity using centralized policy enforcement
- Apply least privilege to administrative recovery and account-unlock operations
Mitigation generally focuses on making lockout controls resistant to unauthenticated abuse while preserving protection against password guessing.
Common defensive patterns include:
- Prefer graduated throttling, exponential backoff, or risk-based challenges over permanent or easily triggered lockouts
- Avoid exposing whether a submitted identifier corresponds to an existing account
- Apply controls across account, source, device, and session dimensions rather than relying on a single account-level threshold
- Provide secure, rate-limited recovery paths that do not reveal account status
- Monitor and limit repeated authentication activity using centralized policy enforcement
- Apply least privilege to administrative recovery and account-unlock operations
How teams detect issues like this
Organizations can identify this class of issue through:
- Static and dynamic analysis of authentication handlers for lockout decisions based solely on user-controlled identifiers
- Code review checks covering account enumeration, failure thresholds, unlock behavior, and distributed request handling
- Tests verifying that unauthenticated activity cannot indefinitely disable a known account
- Monitoring for repeated failed-login events concentrated on individual accounts or distributed across many source addresses
- Policy enforcement requiring throttling, anomaly detection, and non-enumerating authentication responses
Automated security testing and code review tools may help detect missing abuse controls, but lockout behavior should also be validated with integration tests.
Organizations can identify this class of issue through:
- Static and dynamic analysis of authentication handlers for lockout decisions based solely on user-controlled identifiers
- Code review checks covering account enumeration, failure thresholds, unlock behavior, and distributed request handling
- Tests verifying that unauthenticated activity cannot indefinitely disable a known account
- Monitoring for repeated failed-login events concentrated on individual accounts or distributed across many source addresses
- Policy enforcement requiring throttling, anomaly detection, and non-enumerating authentication responses
Automated security testing and code review tools may help detect missing abuse controls, but lockout behavior should also be validated with integration tests.
