FileRise EUVD-2026-101681

No special product configuration is required - the weakness is in the default failed-login key logic (IP+username) in AuthModel::getFailedLoginKey(), so a remote unauthenticated attacker can exploit it against default FileRise deployments prior to 3.21.0 that expose the login endpoint to the network. Practical success is LIMITED by whether weak or guessable credentials actually exist on target accounts (the flaw only weakens brute-force protection; it does not itself defeat authentication). Effectiveness is also affected by deployment topology: the vendor upgrade notes indicate instances behind reverse proxies must have trusted proxy/real-client-IP settings correct, since misconfigured IP handling changes how throttling (and thus the bypass) behaves.

This is a medium-severity (CVSS 6.5) authentication-throttling weakness, and the signals are consistent in pointing to a real-but-bounded risk rather than an urgent emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:N) is attacker-favorable - remote, unauthenticated, low-complexity, no user interaction - which explains the 6.5 despite limited direct impact. However, the impact metrics (C:L/I:N/A:L, Scope:Unchanged) correctly reflect that the flaw itself does not grant access, execute code, or bypass authentication; it degrades a brute-force mitigation (CWE-307), making credential-guessing attacks cheaper and enabling account enumeration via distinguishable throttling. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. There is no CISA KEV listing and no public exploit identified at time of analysis, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The key caveat: real-world impact is entirely contingent on weak or guessable credentials existing on the target - a hardened deployment with strong passwords/MFA faces little practical risk, while one relying on password strength alone is meaningfully more exposed. Net: a legitimate patch-worthy issue, not a drop-everything priority.

A remote unauthenticated attacker targets a public FileRise instance and performs password spraying: for each candidate password they cycle through many usernames, and because failed-login tracking keys on IP+username together, each new username grants a fresh attempt budget that evades the intended per-source limit. Over time this lets the attacker test common passwords across many accounts from a single source without being throttled, and the per-user throttling differences also leak which usernames are valid. No public proof-of-concept is identified in the provided data.