CVE-2026-77057

The record

boneIO Black does not limit authentication attempts on its web interface (POST /api/login) or SSH service, and does not enforce password complexity. An unauthenticated remote attacker can make unlimited brute-force login attempts, potentially compromising user accounts and gaining unauthorized access to the device. This issue was fixed in version 1.6.0: web login attempts are rate-limited per source address and per account, panel passwords must be at least 8 characters long, and SSH allows three authentication attempts per connection with a shortened login grace time.

Affected packages

Related vulnerabilities

• CVE-2026-121535 A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87. CWE-307
• CVE-2026-118505 Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic… CWE-307
• CVE-2026-116238 In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins… CWE-307
• CVE-2026-111501 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Restriction of… CWE-307
• CVE-2026-22114 HTTP basic auth enforces no retry limit or backoff. CWE-307
• CVE-2026-107256 Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield… CWE-307
• CVE-2026-15586 Improper restriction of excessive authentication attempts vulnerability in İdvlabs… CWE-307
• CVE-2026-107145 The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the… CWE-307