dataCycle-CORE Brute-Force Vulnerability in Login Endpoints Allowing Unlimited Password Guesses

A vulnerability exists in dataCycle-CORE versions prior to 25.07.3, where the application allows unlimited password attempts on both the web login interface and the JSON login API. This issue arises because the user model's Devise ':lockable' module is enabled, but the lock and unlock strategies are disabled, leaving no request throttling or rate-limiting. As a result, valid user accounts can be targeted continuously without temporary lockout. The vulnerability is present on the '/users/sign_in' and '/api/v4/auth/login' endpoints. Successful password guessing provides a standard session cookie in the web application or a new JWT in the API, which is particularly susceptible to automation since it does not require a CSRF token.

Impact

The lack of brute-force protection on the login endpoints creates a direct risk of online password guessing attacks, allowing attackers to continuously attempt to guess passwords for valid user accounts without facing any temporary lockout.

Remediation

Users can upgrade to dataCycle-CORE version 26.06.08 to address this vulnerability.