WebSocket Authentication Brute-Force via Missing Rate Limiting (CVE-2026-27778)

Metadata

Affected Target

Summary

This repository is a hands-on simulator for CVE-2026-27778 (CWE-307: Improper Restriction of Excessive Authentication Attempts) built around a small Node.js/Express server that accepts WebSocket AUTH_REQ messages containing a password guess and replies with success/failure. Because the server (mode 1) never throttles or locks out repeated authentication attempts on the same connection, a client can flood it with password guesses at a fixed interval until the correct password is found. The included attack.js browser/Node script opens a WebSocket connection and fires an incrementing password guess every 50ms in a tight loop, logging the elapsed time once the server confirms a match. server.js and run.js provide two variants of the vulnerable backend (one with an optional lockout “mode 2” for comparison, one broadcasting auth results to all connected monitoring clients), letting a user directly observe the difference between rate-limited and unprotected configurations.

Vulnerability Details

Root Cause

The WebSocket message handler for AUTH_REQ compares the supplied password to a fixed secret and returns the result immediately, with no per-connection or per-IP attempt counter, delay, or lockout enforced by default (mode 1), allowing unlimited automated guesses.

Attack Vector

1. Open a WebSocket connection to the target’s authentication endpoint.
2. Continuously send AUTH_REQ messages with incrementing/dictionary password guesses at a fixed short interval.
3. Monitor incoming AUTH_RES messages for a success: true response.
4. Stop once the correct credential is identified, having brute-forced the password with no throttling encountered.

Impact

Full compromise of the guessable credential via automated brute force, with attack speed limited only by network/server throughput rather than any defensive control.

Environment / Lab Setup

Target:   Node.js server (server.js / run.js) exposing a WebSocket AUTH_REQ endpoint on port 3000
Attacker: Node.js or a browser console to run attack.js against ws://<target>:3000

Proof of Concept

PoC Script

See attack.js, server.js, and run.js in this folder.

1
2

node server.js        # start the vulnerable WebSocket auth server
node attack.js         # run the brute-force client against ws://target-server-url

attack.js opens a WebSocket connection and sends an AUTH_REQ message with an incrementing password guess every 50ms, logging the total elapsed time once the server responds with success: true.

Detection & Indicators of Compromise

Signs of compromise:

• Large volume of failed AUTH_RES (success: false) responses to a single WebSocket connection in a short window
• Sustained ~20 requests/second authentication traffic from one client
• Eventual single AUTH_RES success: true following a long run of failures from the same source

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/KimJ6/PoC-Simulator_CVE-2026-27778 on 2026-07-05.