~ / search / GHSA-j6g5-p62x-58hw

GHSA-j6g5-p62x-58hw

vantage6 lacks brute-force protection on change password functionality

Source: GitHub Advisory Database (reviewed) Low CVE-2025-43863

Packages

EcosystemPackageAffectedFixed in
PyPI vantage6 < 4.11.0 4.11.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact If attacker gets access to an authenticated session, they can try to brute-force the user password by using the change password functionality: they can call that route infinitely which will return the message that password is wrong until it is correct ### Patches This issue has been patched in version 4.11.0 ### Workarounds None

References

External links from the advisory. They lead to third-party sites.