What’s Vulnerable › Vulnerabilities

CVE-2022-2321: Improper Restriction of Excessive Authentication Attempts in heroiclabs/nakama

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-07-05 · updated 2026-06-17
• Weakness: CWE-307

Description

Improper Restriction of Excessive Authentication Attempts in GitHub repository heroiclabs/nakama prior to 3.13.0. This results in login brute-force attacks.

Affected products

• heroiclabs/nakama: before 3.13.0 — fixed in 3.13.0

How to fix

Upgrade to a fixed version: heroiclabs/nakama 3.13.0. Check the vendor advisory for mitigations.

References

• https://github.com/heroiclabs/nakama/commit/e2e02fce80ff33ce45f8a6ebc0b7a99ee0b03824
• https://huntr.dev/bounties/3055b3f5-6b80-4d47-8e00-3500dfb458bc
• https://github.com/heroiclabs/nakama/commit/e2e02fce80ff33ce45f8a6ebc0b7a99ee0b03824
• https://huntr.dev/bounties/3055b3f5-6b80-4d47-8e00-3500dfb458bc

Get alerted when CVE-2022-2321 or the next vulnerability affects your stack