CWE-645
Overly Restrictive Account Lockout Mechanism
The product contains an account lockout protection mechanism, but the mechanism is too restrictive and can be triggered too easily, which allows attackers to deny service to legitimate users by causing their accounts to be locked out.
Impactr finds and proves whether CWE-645 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.