Raytha CMS does not implement any brute‑force protection, allowing attackers to send an unlimited number of automated login requests against the authentication endpoint. This weakness is a failure of brute‑force protection (CWE‑307) and can enable credential stuffing or unauthorized access. The impact is that compromised user credentials may grant an attacker access to sensitive application data and functions.

The vulnerability affects all Raytha CMS releases prior to version 1.4.6. Users running those versions are exposed to brute‑force login attempts, while the issue is resolved in 1.4.6 and later.

The CVSS base score of 6.9 indicates moderate severity, and the EPSS score of less than 1 % suggests a low likelihood of exploitation. The issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending many requests to the login endpoint from any location, provided the application does not enforce connection limits or additional delays. The exploit requires only network access to the web interface and does not rely on privileged configuration, making it straightforward to test if the system lacks external anti‑brute‑force controls. The overall risk is moderate given the severity metric but low due to the low probability of real‑world exploitation without external defenses.