A lack of authentication rate-limiting in Typemill versions up to 2.25.0 creates a high risk of unauthorized account access through brute-force attacks.

This is an improper restriction of excessive authentication attempts (CWE-307) occurring within the ControllerWebAuth login function. The vulnerability is exploitable by unauthenticated remote attackers.

The absence of account lockout or rate-limiting measures significantly increases the risk of successful credential stuffing or brute-force attacks against administrative or user accounts. With a CVSS score of 8.1, this vulnerability is considered High severity, as it could lead to full unauthorized access to the application and sensitive data compromise.

Immediate Action: Ensure the CAPTCHA feature is enabled in the Typemill configuration to mitigate automated login attempts while awaiting a formal security patch.

Proactive Monitoring: Review web access logs for high volumes of POST requests to the /tm/login endpoint originating from single or suspicious IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to rate-limit requests to the login endpoint and block IP addresses exhibiting aggressive authentication patterns.

Public Exploit Available: No

Given the High severity score, administrators must prioritize securing the authentication process immediately. Enabling the CAPTCHA is a vital, non-disruptive step to prevent account takeover attempts until an official update providing robust rate-limiting is released.