A critical lack of authentication rate limiting in Eclipse GlassFish allows for prolonged brute-force attacks against administrative or user accounts.

This vulnerability (CWE-307) stems from an improper restriction of excessive authentication attempts, allowing unauthenticated attackers to perform unlimited login attempts against the system.

The absence of brute-force protection significantly increases the risk of unauthorized account access through credential stuffing or dictionary attacks. If successful, an attacker could gain administrative control over the application server, leading to full system compromise, data theft, or service disruption, justifying the critical CVSS score of 9.8.

Immediate Action: Implement account lockout policies or rate-limiting at the Web Application Firewall (WAF) or load balancer level to mitigate brute-force attempts.

Proactive Monitoring: Monitor authentication logs for high volumes of failed login attempts from single or multiple IP addresses.

Compensating Controls: Enforce Multi-Factor Authentication (MFA) for all administrative interfaces to render brute-force attacks ineffective even if a password is guessed.

Public Exploit Available: Unknown

While waiting for a vendor-supplied patch, organizations must deploy compensating controls such as WAF-based rate limiting or MFA to protect against brute-force attacks. Securing the authentication entry point is of the highest priority to prevent unauthorized access.