CWE-307 is the weakness class for poor resistance to repeated failed authentication attempts. It describes login systems that do not adequately slow, block, or isolate guessing activity, making online brute-force attacks much easier.
This matters because authentication is often the first barrier to administrative access. If a service lacks rate limiting, account lockout, source-based restrictions, or other throttling, attackers can automate password guessing against exposed interfaces such as web consoles, VPN portals, or device management APIs. Defenders reduce the risk with strong unique passwords, MFA where possible, strict allowlists, firewall filtering, and network segmentation. In practice, CWE-307 often appears in products that expose management services to untrusted networks, where even small delays or session limits may be too weak to stop distributed guessing.