JATOS Authentication System Denial-of-Service Vulnerability Allowing Account Lockout

A denial-of-service vulnerability has been identified in JATOS version 3.9.4, affecting the authentication system. This vulnerability allows an attacker to lock legitimate users out of their accounts by sending repeated failed login attempts. Specifically, submitting three incorrect login attempts per minute can trigger the account lockout mechanism, locking the user out indefinitely. The lockout is applied at the account level, not based on IP address, enabling any attacker to lock out any user account, regardless of privileges.

Impact

Exploitation of this vulnerability leads to indefinite account lockout for affected users.