CVE-2021-37934

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-12-10 · updated 2026-06-17
Weakness: CWE-307

Description

Due to insufficient server-side login-attempt limit enforcement, a vulnerability in /account/login in Huntflow Enterprise before 3.10.14 could allow an unauthenticated, remote user to perform multiple login attempts for brute-force password guessing.

Affected products

Huntflow Enterprise: before 3.10.14 — fixed in 3.10.14

How to fix

Upgrade to a fixed version: Huntflow Enterprise 3.10.14. Check the vendor advisory for mitigations.

References

https://gist.github.com/andrey-lomtev/4ec9004101152ea9d0043a09d59498a6
https://gist.github.com/andrey-lomtev/4ec9004101152ea9d0043a09d59498a6

Get alerted when CVE-2021-37934 or the next vulnerability affects your stack