Rate limiting for user logins is improperly enforced in HCL DevOps Velocity, allowing attackers to repeatedly attempt credentials. This flaw falls under credential misuse (CWE‑307) and can lead to unauthorized account access or service disruption. The CVSS score of 6.8 signals a moderate‑to‑high risk for a single system or broader deployment.

All HCL Software DevOps Velocity installations prior to version 5.1.7 are vulnerable. The vendor has released a fix in 5.1.7; no additional version details are supplied, so all earlier releases should be considered affected.

The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that no mass exploitation is currently known. The exploitation vector is inferred to be remote through the web login interface, requiring no special privileges beyond access to the service. Although the risk is moderate, repeated brute‑force attempts could lead to account breaches or denial of service.