CVE Vulnerabilities

CVE-2025-35041

Improper Restriction of Excessive Authentication Attempts

Published: Sep 22, 2025 | Modified: Sep 22, 2025
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

Airship AI Acropolis allows unlimited MFA attempts for 15 minutes after a user has logged in with valid credentials. A remote attacker with valid credentials could brute-force the 6-digit MFA code. Fixed in 10.2.35, 11.0.21, and 11.1.9.

Weakness

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Potential Mitigations

  • Common protection mechanisms include:

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].

  • Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]

References